diff --git a/cyrus-imapd.spec b/cyrus-imapd.spec
index 6246d86..dfc6429 100644
--- a/cyrus-imapd.spec
+++ b/cyrus-imapd.spec
@@ -1,7 +1,7 @@
 %define upstream_ver 2.3.9
 Name: cyrus-imapd
 Version: 2.3.9
-Release: 7%{?dist}
+Release: 8%{?dist}
 
 # ********************** BUILD TIME OPTIONS START **********************
 
@@ -576,34 +576,6 @@ fi
  %{_sysconfdir}/imapd.conf
 %endif
 
-%preun
-if [ $1 = 0 ]; then
-  /sbin/service %{name} stop >/dev/null 2>&1 || :
-  /sbin/chkconfig --del %{name}
-  %{__rm} -f %{_vardata}/socket/* 2> /dev/null
-  %{__rm} -f %{_vardata}/proc/* 2> /dev/null
-%if %{_withldap}
-  %{__rm} -f %{_vardata}/ptclient/ptsock 2> /dev/null
-%endif
-fi
-
-%postun
-if [ $1 != 0 ]; then
-  /sbin/service %{name} condrestart >/dev/null 2>&1 || :
-fi
-
-%pre utils
-# Create 'cyrus' user on target host
-%if %{SASLGROUP}
-/usr/sbin/groupadd -g %{gid} -r %{_saslgroup} 2> /dev/null || :
-/usr/sbin/useradd -c "Cyrus IMAP Server" -d %{_vardata} -g %{_cyrusgroup} \
-  -G %{_saslgroup} -s /bin/bash -u %{uid} -r %{_cyrususer} 2> /dev/null || :
-%else
-/usr/sbin/useradd -c "Cyrus IMAP Server" -d %{_vardata} -g %{_cyrusgroup} \
-  -s /bin/bash -u %{uid} -r %{_cyrususer} 2> /dev/null || :
-%endif
-
-%post utils
 # Create SSL certificates
 exec > /dev/null 2> /dev/null
 %if %{use_etc_pki}
@@ -632,6 +604,34 @@ mv %{name}.pem %{ssl_pem_file}
 popd
 fi
 
+%preun
+if [ $1 = 0 ]; then
+  /sbin/service %{name} stop >/dev/null 2>&1 || :
+  /sbin/chkconfig --del %{name}
+  %{__rm} -f %{_vardata}/socket/* 2> /dev/null
+  %{__rm} -f %{_vardata}/proc/* 2> /dev/null
+%if %{_withldap}
+  %{__rm} -f %{_vardata}/ptclient/ptsock 2> /dev/null
+%endif
+fi
+
+%postun
+if [ $1 != 0 ]; then
+  /sbin/service %{name} condrestart >/dev/null 2>&1 || :
+fi
+
+%pre utils
+# Create 'cyrus' user on target host
+%if %{SASLGROUP}
+/usr/sbin/groupadd -g %{gid} -r %{_saslgroup} 2> /dev/null || :
+/usr/sbin/useradd -c "Cyrus IMAP Server" -d %{_vardata} -g %{_cyrusgroup} \
+  -G %{_saslgroup} -s /bin/bash -u %{uid} -r %{_cyrususer} 2> /dev/null || :
+%else
+/usr/sbin/useradd -c "Cyrus IMAP Server" -d %{_vardata} -g %{_cyrusgroup} \
+  -s /bin/bash -u %{uid} -r %{_cyrususer} 2> /dev/null || :
+%endif
+
+%post utils
 # Add service entries if necessary
 if ! %{__grep} -q ^lmtp %{_sysconfdir}/services; then
   echo -e 'lmtp\t\t24/tcp\t\t\t\t# LMTP Mail Delivery over TCP' >> %{_sysconfdir}/services
@@ -803,6 +803,10 @@ fi
 %{_mandir}/man1/*
 
 %changelog
+* Tue Dec 04 2007 Tomas Janousek <tjanouse@redhat.com> - 2.3.9-8
+- move certificate creation from -utils postinst to main package
+- rebuild with newer openssl and openldap
+
 * Sun Sep 23 2007 Tomas Janousek <tjanouse@redhat.com> - 2.3.9-7
 - updated the getgrouplist patch
 - fixed a few undeclared functions (and int to pointer conversions)