diff --git a/certs.tar.bz2 b/certs.tar.bz2
deleted file mode 100644
index 04d574a..0000000
--- a/certs.tar.bz2
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:6b8dff8e46383f941bc1a6c084e40aad6a67699b9b814c9d1a0b2a17d3b84039
-size 17917
diff --git a/openssl.changes b/openssl.changes
index a745f53..98d5f21 100644
--- a/openssl.changes
+++ b/openssl.changes
@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Wed Jul  9 12:53:27 CEST 2008 - mkoenig@suse.de
+
+- remove the certs subpackage from the openssl package
+  and move the CA root certificates into a package of its own
+
 -------------------------------------------------------------------
 Tue Jun 24 09:09:04 CEST 2008 - mkoenig@suse.de
 
diff --git a/openssl.spec b/openssl.spec
index 9d608e4..e019aa1 100644
--- a/openssl.spec
+++ b/openssl.spec
@@ -20,11 +20,10 @@ Group:          Productivity/Networking/Security
 Provides:       ssl
 AutoReqProv:    on
 Version:        0.9.8h
-Release:        1
+Release:        3
 Summary:        Secure Sockets and Transport Layer Security
 Url:            http://www.openssl.org/
 Source:         http://www.%{name}.org/source/%{name}-%{version}.tar.bz2
-Source1:        certs.tar.bz2
 Source10:       README.SuSE
 Patch0:         openssl-0.9.8-sparc.dif
 Patch1:         openssl-0.9.8-flags-priority.dif
@@ -104,7 +103,7 @@ Authors:
 
 %package -n libopenssl-devel
 License:        BSD 3-Clause
-Summary:        Include Files and Libraries mandatory for Development.
+Summary:        Include Files and Libraries mandatory for Development
 Group:          Development/Libraries/C and C++
 # openssl-devel last used in openSUSE 10.2
 Obsoletes:      openssl-devel <= 0.9.8e-8
@@ -128,43 +127,9 @@ Authors:
     Holger Reif <holger@openssl.org>
     Paul C. Sutton <paul@openssl.org>
 
-%package certs
-License:        BSD 3-Clause
-Summary:        Secure Sockets and Transport Layer Security
-Group:          Productivity/Networking/Security
-
-%description certs
-The OpenSSL Project is a collaborative effort to develop a robust,
-commercial-grade, full-featured, and open source toolkit implementing
-the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS
-v1) protocols with full-strength cryptography. The project is managed
-by a worldwide community of volunteers that use the Internet to
-communicate, plan, and develop the OpenSSL toolkit and its related
-documentation.
-
-Derivation and License
-
-OpenSSL is based on the excellent SSLeay library developed by Eric A.
-Young and Tim J. Hudson. The OpenSSL toolkit is licensed under an
-Apache-style license, which basically means that you are free to get it
-and to use it for commercial and noncommercial purposes.
-
-
-
-Authors:
---------
-    Mark J. Cox <mark@openssl.org>
-    Ralf S. Engelschall <rse@openssl.org>
-    Dr. Stephen Henson <steve@openssl.org>
-    Ben Laurie <ben@openssl.org>
-    Bodo Moeller <bodo@openssl.org>
-    Ulf Moeller <ulf@openssl.org>
-    Holger Reif <holger@openssl.org>
-    Paul C. Sutton <paul@openssl.org>
-
 %package doc
 License:        BSD 3-Clause
-Summary:        Additional Package Documentation.
+Summary:        Additional Package Documentation
 Group:          Productivity/Networking/Security
 
 %description doc
@@ -196,7 +161,6 @@ Authors:
 %patch6 -p1
 %patch7
 cp -p %{S:10} .
-tar xjf %{SOURCE1}
 # lib64 installation fixes
 for i in Makefile.org engines/Makefile; do
 sed -e 	"s+\(\$(INSTALL_PREFIX)\$(INSTALLTOP)\)/lib+\1/%_lib+g" \
@@ -397,19 +361,19 @@ if ! test -f /.buildenv; then rm -rf $RPM_BUILD_ROOT; fi
 %doc CHANGE* INSTAL* AVAILABLE_CIPHERS
 %doc LICENSE NEWS README README.SuSE
 %dir %{ssletcdir}
+%dir %{ssletcdir}/certs
+%{ssletcdir}/certs/*
 %config (noreplace) %{ssletcdir}/openssl.cnf
 %attr(700,root,root) %{ssletcdir}/private
-%{ssletcdir}/certs
 %dir %{_datadir}/ssl
 %{_datadir}/ssl/misc
 %{_bindir}/c_rehash
 %{_bindir}/%{name}
 
-%files certs
-%defattr(-, root, root)
-%{ssletcdir}/certs
-
 %changelog
+* Wed Jul 09 2008 mkoenig@suse.de
+- remove the certs subpackage from the openssl package
+  and move the CA root certificates into a package of its own
 * Tue Jun 24 2008 mkoenig@suse.de
 - update to version 0.9.8h
 - openssl does not ship CA root certificates anymore