diff --git a/xrdp.changes b/xrdp.changes
index d2abe4d..15fc118 100644
--- a/xrdp.changes
+++ b/xrdp.changes
@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Thu Aug  2 14:28:28 UTC 2018 - bwiedemann@suse.com
+
+- Drop unused private key.pem to make build reproducible
+  (boo#1062303)
+
 -------------------------------------------------------------------
 Fri Jun 29 12:37:10 UTC 2018 - fezhang@suse.com
 
diff --git a/xrdp.spec b/xrdp.spec
index 5b3481f..5a06a98 100644
--- a/xrdp.spec
+++ b/xrdp.spec
@@ -131,9 +131,9 @@ install -m 755 %{SOURCE5} %{buildroot}/%{_prefix}/lib/initscripts/legacy-actions
 ln -sf %{_sbindir}/service %{buildroot}%{_sbindir}/rcxrdp
 ln -sf %{_sbindir}/service %{buildroot}%{_sbindir}/rcxrdp-sesman
 
-# remove a certification file generated during make and
+# remove a private key and certification file generated during make and
 # use certification file created at the post phase
-rm -rf %{buildroot}/%{_sysconfdir}/xrdp/cert.pem
+rm -f %{buildroot}/%{_sysconfdir}/xrdp/{cert,key}.pem
 
 %fdupes -s %{buildroot}