diff --git a/PayPalEE.cert b/PayPalEE.cert
new file mode 100644
index 0000000..7dfb1c7
Binary files /dev/null and b/PayPalEE.cert differ
diff --git a/mozilla-nss.changes b/mozilla-nss.changes
index 8801912..775eed7 100644
--- a/mozilla-nss.changes
+++ b/mozilla-nss.changes
@@ -1,9 +1,14 @@
+-------------------------------------------------------------------
+Tue Nov  9 08:51:51 UTC 2010 - wr@rosenauer.org
+
+- replaced expired PayPal test certificate (fixing testsuite)
+
 -------------------------------------------------------------------
 Sat Sep 25 08:18:59 CEST 2010 - wr@rosenauer.org
 
 - update to 3.12.8 RTM release
   * support TLS false start (needed for Firefox4) (bmo#525092)
-  * fix wildcard matching for IP addresses (bnc#637290, bmo#578697) 
+  * fix wildcard matching for IP addresses (bnc#637290, bmo#578697)
     (CVE-2010-3170)
   * bugfixes
 
@@ -24,7 +29,7 @@ Fri Jul  9 16:32:33 UTC 2010 - jengelh@medozas.de
 -------------------------------------------------------------------
 Thu Jun  3 22:45:51 CEST 2010 - wr@rosenauer.org
 
-- Use preloaded empty system database since creating with 
+- Use preloaded empty system database since creating with
   modutil leaves database in nonusable state
 
 -------------------------------------------------------------------
diff --git a/mozilla-nss.spec b/mozilla-nss.spec
index a83831a..b35dbbd 100644
--- a/mozilla-nss.spec
+++ b/mozilla-nss.spec
@@ -30,7 +30,7 @@ BuildRequires:  sqlite3-devel
 %endif
 License:        GPLv2+ ; LGPLv2.1+ ; MPL
 Version:        3.12.8
-Release:        1
+Release:        2
 # bug437293
 %ifarch ppc64
 Obsoletes:      mozilla-nss-64bit
@@ -49,6 +49,7 @@ Source6:        setup-nsssysinit.sh
 Source7:        cert9.db
 Source8:        key4.db
 Source9:        pkcs11.txt
+Source10:       PayPalEE.cert
 Patch1:         nss-opt.patch
 Patch3:         system-nspr.patch
 Patch4:         char.patch
@@ -78,7 +79,7 @@ certificates, and other security standards.
 License:        GPLv2+ ; LGPLv2.1+ ; MPL
 Summary:        Network (Netscape) Security Services development files
 Group:          Development/Libraries/Other
-Requires:       mozilla-nspr-devel 
+Requires:       mozilla-nspr-devel
 Requires:       mozilla-nss = %{version}-%{release}
 Requires:       libfreebl3
 Requires:       libsoftokn3
@@ -137,7 +138,7 @@ This package installs the freebl library from NSS.
 
 %package -n libsoftokn3
 License:        GPLv2+ ; LGPLv2.1+ ; MPL
-Summary:        Network Security Services Soktoken Module 
+Summary:        Network Security Services Soktoken Module
 Group:          System/Libraries
 Requires:       libfreebl3 = %{version}-%{release}
 
@@ -148,7 +149,7 @@ applications. Applications built with NSS can support SSL v2 and v3,
 TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3
 certificates, and other security standards.
 
-Network Security Services Softoken Cryptographic Module 
+Network Security Services Softoken Cryptographic Module
 
 
 %package certs
@@ -157,7 +158,7 @@ Summary:        CA certificates for NSS
 Group:          Productivity/Networking/Security
 
 %description certs
-This package contains the integrated CA root certificates from the 
+This package contains the integrated CA root certificates from the
 Mozilla project.
 
 
@@ -178,11 +179,12 @@ cd mozilla
 #make generate
 
 %build
-export FREEBL_NO_DEPEND=1
 cd mozilla/security/nss
+cp %SOURCE10 tests/libpkix/certs/PayPalEE.cert
+export FREEBL_NO_DEPEND=1
 export NSPR_INCLUDE_DIR=`nspr-config --includedir`
 export NSPR_LIB_DIR=`nspr-config --libdir`
-export OPT_FLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing" 
+export OPT_FLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing"
 export LIBDIR=%{_libdir}
 %ifarch x86_64 s390x ppc64 ia64
 export USE_64=1