diff --git a/neon-0.30.2-nulcert.patch b/neon-0.30.2-nulcert.patch
new file mode 100644
index 0000000..874d92a
--- /dev/null
+++ b/neon-0.30.2-nulcert.patch
@@ -0,0 +1,35 @@
+From 1678726ca3198f0a495a26647cdc7c8ed2e3c709 Mon Sep 17 00:00:00 2001
+From: Joe Orton <jorton@redhat.com>
+Date: Wed, 14 Aug 2019 15:47:48 +0100
+Subject: [PATCH] * test/ssl.c: Update failures since the nul*.pem certs
+ expired.
+
+---
+ test/ssl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/test/ssl.c b/test/ssl.c
+index 870a3de..266b2a5 100644
+--- a/test/ssl.c
++++ b/test/ssl.c
+@@ -889,7 +889,7 @@ static int fail_nul_cn(void)
+     CALL(fail_ssl_request_with_error2(nul_cn_fn, key, ca,
+                                       "www.bank.com", "localhost",
+                                       "certificate with incorrect CN was accepted",
+-                                      NE_SSL_IDMISMATCH,
++                                      NE_SSL_IDMISMATCH|NE_SSL_EXPIRED|NE_SSL_BADCHAIN,
+                                       "certificate issued for a different hostname"));
+     ne_free(key);
+     ne_free(ca);
+@@ -904,7 +904,7 @@ static int fail_nul_san(void)
+     CALL(fail_ssl_request_with_error2(cert, key, ca, 
+                                       "www.bank.com", "localhost",
+                                       "certificate with incorrect CN was accepted",
+-                                      NE_SSL_IDMISMATCH,
++                                      NE_SSL_IDMISMATCH|NE_SSL_EXPIRED|NE_SSL_BADCHAIN,
+                                       "certificate issued for a different hostname"));
+     ne_free(cert);
+     ne_free(key);
+-- 
+2.16.4
+
diff --git a/neon.changes b/neon.changes
index 4504266..1ff001e 100644
--- a/neon.changes
+++ b/neon.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Mon Aug 19 07:29:30 UTC 2019 - Ludwig Nussel <lnussel@suse.de>
+
+- fix testsuite fail due to expired nulcerts (neon-0.30.2-nulcert.patch)
+
 -------------------------------------------------------------------
 Fri Oct 19 13:32:40 UTC 2018 - Ismail Dönmez <idonmez@suse.com>
 
diff --git a/neon.spec b/neon.spec
index d8b2e8b..1370066 100644
--- a/neon.spec
+++ b/neon.spec
@@ -1,7 +1,7 @@
 #
 # spec file for package neon
 #
-# Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany.
+# Copyright (c) 2019 SUSE LINUX GmbH, Nuernberg, Germany.
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -32,6 +32,8 @@ Source10:       replace_manpage_with_links.sh
 Patch0:         %{name}-0.28.4-bloat.patch
 Patch1:         fix_timeout_tests_for_ppc64le.patch
 Patch2:         neon-0.30.2_ssl-fix_timeout_retvals.patch
+# backport from upstream
+Patch3:         neon-0.30.2-nulcert.patch
 BuildRequires:  krb5-devel
 BuildRequires:  libexpat-devel
 BuildRequires:  libopenssl-1_1-devel >= 1.1.1
@@ -75,6 +77,7 @@ neon is an HTTP and WebDAV client library with a C interface.
 %patch1
 %endif
 %patch2 -p1
+%patch3 -p1
 
 %build
 rm -f aclocal.m4 ltmain.sh