diff --git a/python-setuptools.changes b/python-setuptools.changes
index 95575cd..008a741 100644
--- a/python-setuptools.changes
+++ b/python-setuptools.changes
@@ -1,3 +1,11 @@
+-------------------------------------------------------------------
+Wed Aug 31 14:56:46 UTC 2016 - jmatejek@suse.com
+
+- fix certificate handling with certifi, add support for SUSE's
+  CA bundle (setuptools-certpath.patch, fixes boo#993968)
+- remove shebang lines, strip executable bit from README, to silence
+  the easy rpmlint warnings
+
 -------------------------------------------------------------------
 Tue Aug 30 08:08:13 UTC 2016 - tbechtold@suse.com
 
diff --git a/python-setuptools.spec b/python-setuptools.spec
index c2d4c44..d3c967f 100644
--- a/python-setuptools.spec
+++ b/python-setuptools.spec
@@ -29,6 +29,8 @@ Source2:        zpl.txt
 Patch1:         setuptools-5.4.1-create-sitedir.patch
 # NOTE(toabctl): Fix for SLE11SP3 test failures
 Patch3:         fix-sle11-test-failure.patch
+# PATCH-FIX-UPSTREAM better handling of certificate store in SUSE
+Patch4:         setuptools-certpath.patch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 BuildRequires:  python-devel
 BuildRequires:  python-xml
@@ -36,6 +38,7 @@ BuildRequires:  python-xml
 Requires:       python
 Requires:       python-six
 Requires:       python-xml
+Recommends:     ca-certificates-mozilla
 Requires(post): update-alternatives
 Requires(postun): update-alternatives
 # NOTE(saschpe): Distribute was merged into 0.7.x, so even though distribute
@@ -58,9 +61,21 @@ especially ones that have dependencies on other packages.
 %patch1 -p1
 %if 0%{?suse_version} && 0%{?suse_version} <= 1220
 %patch3 -p1
+%patch4 -p1
 %endif
 find . -type f -name "*.orig" -delete
 
+# fix rpmlint spurious-executable-perm
+chmod -x README.rst
+
+# strip shebangs to fix rpmlint warnings
+# "explain the sed":
+# 1 = first line only
+# s@...@...@ = same as s/.../.../ except with @ instead of /
+# ^ = start; #!/ = shebang leading characters; .* = rest of line; $ = end
+# replace with nothing
+sed -r -i '1s@^#!/.*$@@' pkg_resources/_vendor/appdirs.py setuptools/command/easy_install.py
+
 %build
 python setup.py build
 
diff --git a/setuptools-certpath.patch b/setuptools-certpath.patch
new file mode 100644
index 0000000..fa665aa
--- /dev/null
+++ b/setuptools-certpath.patch
@@ -0,0 +1,21 @@
+diff --git a/setuptools/ssl_support.py b/setuptools/ssl_support.py
+index f4ba8a9..1627263 100644
+--- a/setuptools/ssl_support.py
++++ b/setuptools/ssl_support.py
+@@ -26,6 +26,7 @@ cert_paths = """
+ /etc/ssl/cert.pem
+ /System/Library/OpenSSL/certs/cert.pem
+ /usr/local/share/certs/ca-root-nss.crt
++/etc/ssl/ca-bundle.pem
+ """.strip().split()
+ 
+ 
+@@ -242,6 +243,7 @@ def find_ca_bundle():
+             if os.path.isfile(cert_path):
+                 return cert_path
+     try:
+-        return pkg_resources.resource_filename('certifi', 'cacert.pem')
++        import certifi
++        return certifi.where()
+     except (ImportError, ResolutionError, ExtractionError):
+         return None