diff --git a/pesign-efikeygen-Fix-the-build-with-nss-3.44.patch b/pesign-efikeygen-Fix-the-build-with-nss-3.44.patch
new file mode 100644
index 0000000..f26374a
--- /dev/null
+++ b/pesign-efikeygen-Fix-the-build-with-nss-3.44.patch
@@ -0,0 +1,45 @@
+From b535d1ac5cbcdf18a97d97a92581e38080d9e521 Mon Sep 17 00:00:00 2001
+From: Peter Jones <pjones@redhat.com>
+Date: Tue, 14 May 2019 11:28:38 -0400
+Subject: [PATCH] efikeygen: Fix the build with nss 3.44
+
+NSS 3.44 adds some certificate types, which changes a type and makes
+some encoding stuff weird.  As a result, we get:
+
+gcc8 -I/wrkdirs/usr/ports/sysutils/pesign/work/pesign-0.110/include -O2 -pipe  -fstack-protector-strong -Wl,-rpath=/usr/local/lib/gcc8 -isystem /usr/local/include -fno-strict-aliasing  -g -O0 -g -O0  -Wall -fshort-wchar -fno-strict-aliasing -fno-merge-constants --std=gnu99 -D_GNU_SOURCE -Wno-unused-result -Wno-unused-function -I../include/  -I/usr/local/include/nss -I/usr/local/include/nss/nss -I/usr/local/include/nspr  -Werror -fPIC -isystem /usr/local/include -DCONFIG_amd64 -DCONFIG_amd64 -c efikeygen.c -o efikeygen.o
+In file included from /usr/local/include/nss/nss/cert.h:22,
+                 from efikeygen.c:39:
+efikeygen.c: In function 'add_cert_type':
+/usr/local/include/nss/nss/certt.h:445:5: error: unsigned conversion from 'int' to 'unsigned char' changes value from '496' to '240' [-Werror=overflow]
+     (NS_CERT_TYPE_SSL_CLIENT | NS_CERT_TYPE_SSL_SERVER | NS_CERT_TYPE_EMAIL | \
+     ^
+efikeygen.c:208:23: note: in expansion of macro 'NS_CERT_TYPE_APP'
+  unsigned char type = NS_CERT_TYPE_APP;
+                       ^~~~~~~~~~~~~~~~
+cc1: all warnings being treated as errors
+
+This is fixed by just making it an int.
+
+Fixes github issue #48.
+
+Signed-off-by: Peter Jones <pjones@redhat.com>
+---
+ src/efikeygen.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/efikeygen.c b/src/efikeygen.c
+index ede76ef..2cd953e 100644
+--- a/src/efikeygen.c
++++ b/src/efikeygen.c
+@@ -208,7 +208,7 @@ static int
+ add_cert_type(cms_context *cms, void *extHandle, int is_ca)
+ {
+ 	SECItem bitStringValue;
+-	unsigned char type = NS_CERT_TYPE_APP;
++	int type = NS_CERT_TYPE_APP;
+ 
+ 	if (is_ca)
+ 		type |= NS_CERT_TYPE_SSL_CA |
+-- 
+2.22.0
+
diff --git a/pesign.changes b/pesign.changes
index cb8ce39..ee626c9 100644
--- a/pesign.changes
+++ b/pesign.changes
@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Thu Jul 11 09:00:21 UTC 2019 - Gary Ching-Pang Lin <glin@suse.com>
+
+- Add pesign-efikeygen-Fix-the-build-with-nss-3.44.patch to fix
+  the compilation error when building with NSS 3.44
+
 -------------------------------------------------------------------
 Sun Jun  2 07:01:51 UTC 2019 - Jan Engelhardt <jengelh@inai.de>
 
diff --git a/pesign.spec b/pesign.spec
index 0582321..bdc75c2 100644
--- a/pesign.spec
+++ b/pesign.spec
@@ -32,6 +32,8 @@ Patch2:         pesign-privkey_unneeded.diff
 Patch3:         pesign-run.patch
 # PATCH-FIX-UPSTREAM pesign-fix-authvar-write-loop.patch glin@suse.com -- Fix the write loop in authvar
 Patch4:         pesign-fix-authvar-write-loop.patch
+# PATCH-FIX-UPSTREAM pesign-efikeygen-Fix-the-build-with-nss-3.44.patch glin@suse.com -- Fix the NSS 3.44 compilation error
+Patch5:         pesign-efikeygen-Fix-the-build-with-nss-3.44.patch
 BuildRequires:  efivar-devel
 BuildRequires:  libuuid-devel
 BuildRequires:  mozilla-nss-devel
@@ -52,6 +54,7 @@ with the PE and Authenticode specifications.
 %patch2 -p1
 %patch3 -p1
 %patch4 -p1
+%patch5 -p1
 
 %build
 make %{?_smp_mflags} CFLAGS="%{optflags}"