diff --git a/.gitignore b/.gitignore
index da2771d..6534b80 100644
--- a/.gitignore
+++ b/.gitignore
@@ -38,3 +38,4 @@
 /libreswan-4.1.tar.gz
 /libreswan-4.2rc1.tar.gz
 /libreswan-4.2.tar.gz
+/libreswan-4.3.tar.gz
diff --git a/libreswan.spec b/libreswan.spec
index f427450..186356c 100644
--- a/libreswan.spec
+++ b/libreswan.spec
@@ -30,7 +30,7 @@
 Name: libreswan
 Summary: Internet Key Exchange (IKEv1 and IKEv2) implementation for IPsec
 # version is generated in the release script
-Version: 4.2
+Version: 4.3
 Release: %{?prever:0.}1%{?prever:.%{prever}}%{?dist}
 License: GPLv2
 Url: https://libreswan.org/
@@ -194,6 +194,9 @@ certutil -N -d sql:$tmpdir --empty-password
 %doc %{_mandir}/*/*
 
 %changelog
+* Sun Feb 21 2021 Paul Wouters <pwouters@redhat.com> - 4.3-1
+- update to 4.3 (minor bugfix release)
+
 * Wed Feb 03 2021 Paul Wouters <pwouters@redhat.com> - 4.2-1
 - Update to 4.2
 
diff --git a/sources b/sources
index 8a20f6a..8776825 100644
--- a/sources
+++ b/sources
@@ -1,4 +1,4 @@
-SHA512 (libreswan-4.2.tar.gz) = 290be2e36fb41959c9889597aad8ab5df1edc1999ed7315e8f2e50213de073732c91ad497a2b5634f7bc83bca84089ef9f711420a77309c6cce243f1419a2d0f
 SHA512 (ikev1_dsa.fax.bz2) = 627cbac14248bd68e8d22fbca247668a7749ef0c2e41df8d776d62df9a21403d3a246c0bd82c3faedce62de90b9f91a87f753e17b056319000bba7d2038461ac
 SHA512 (ikev1_psk.fax.bz2) = 1b2daec32edc56b410c036db2688c92548a9bd9914994bc7e555b301dd6db4497a6b3e89dc12ddf36826ae90b40fcde501a5a45c0d59098e07839073d219d467
 SHA512 (ikev2.fax.bz2) = 0d3748d1bd574f6f1f3e4db847eca126ce649566ea710ef227426f433122752b80d1d6b8acf9d0df07b5597c1e45447e3a2fcb3391756e834e8e75f99df8e51e
+SHA512 (libreswan-4.3.tar.gz) = 4687c867d34655cd33997edf4ab7887b2121af41c99d1bd9c794fce1c1eef412f5528de7a338e92a44c1c5d0aaa8fbeb756b89849fcad3deb45a418751e64045