diff --git a/openssl.changes b/openssl.changes
index 402efa6..f691fd8 100644
--- a/openssl.changes
+++ b/openssl.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Fri May  4 12:09:57 UTC 2012 - lnussel@suse.de
+
+- don't install any demo or expired certs at all
+
 -------------------------------------------------------------------
 Mon Apr 23 05:57:35 UTC 2012 - gjhe@suse.com
 
diff --git a/openssl.spec b/openssl.spec
index 20b94a1..6737dd5 100644
--- a/openssl.spec
+++ b/openssl.spec
@@ -296,8 +296,7 @@ grep -B1 -A22 "^\*\*\* $PLATFORM$" TABLE
 %install
 rm -rf $RPM_BUILD_ROOT
 make MANDIR=%{_mandir} INSTALL_PREFIX=$RPM_BUILD_ROOT install
-# install standard root certificates
-cp -pr certs/* $RPM_BUILD_ROOT%{ssletcdir}/certs
+install -d -m755 $RPM_BUILD_ROOT%{ssletcdir}/certs
 ln -sf ./%{name} $RPM_BUILD_ROOT/%{_includedir}/ssl
 mkdir $RPM_BUILD_ROOT/%{_datadir}/ssl
 mv $RPM_BUILD_ROOT/%{ssletcdir}/misc $RPM_BUILD_ROOT/%{_datadir}/ssl/
@@ -421,7 +420,6 @@ if ! test -f /.buildenv; then rm -rf $RPM_BUILD_ROOT; fi
 %doc LICENSE NEWS README README.SuSE
 %dir %{ssletcdir}
 %dir %{ssletcdir}/certs
-%{ssletcdir}/certs/*
 %config (noreplace) %{ssletcdir}/openssl.cnf
 %attr(700,root,root) %{ssletcdir}/private
 %dir %{_datadir}/ssl