diff --git a/libexec-check-config.sh b/libexec-check-config.sh
index 6fb51b4..0e6ade8 100755
--- a/libexec-check-config.sh
+++ b/libexec-check-config.sh
@@ -56,7 +56,8 @@ function check_everything()
 {
 	retcode=0
 	check_config_syntax || retcode=1
-	check_certs_perms || retcode=1
+	# TODO: need support for Mozilla NSS, disabling temporarily
+	#check_certs_perms || retcode=1
 	check_db_perms || retcode=1
 	return $retcode
 }
diff --git a/openldap.spec b/openldap.spec
index fc34316..34b0844 100644
--- a/openldap.spec
+++ b/openldap.spec
@@ -6,7 +6,7 @@
 
 Name: openldap
 Version: 2.4.29
-Release: 2%{?dist}
+Release: 1%{?dist}
 Summary: LDAP support libraries
 Group: System Environment/Daemons
 License: OpenLDAP
@@ -649,10 +649,7 @@ exit 0
 %{evolution_connector_prefix}/
 
 %changelog
-* Wed Feb 15 2012 Jan Synáček <jsynacek@redhat.com> 2.4.29-2
-- fix: correct path to check-config.sh in service file
-
-* Mon Feb 13 2012 Jan Vcelak <jvcelak@redhat.com> 2.4.29-1
+* Wed Feb 15 2012 Jan Vcelak <jvcelak@redhat.com> 2.4.29-1
 - new upstream release
   + MozNSS fixes
   + connection handling fixes
@@ -663,6 +660,8 @@ exit 0
   + create empty Mozilla NSS certificate database during installation
   + enable builtin Root CA in generated database (#789088)
   + generate server certificate using Mozilla NSS tools instead of OpenSSL tools
+  + fix: correct path to check-config.sh in service file (Jan Synáček <jsynacek@redhat.com>)
+- temporarily disable certificates checking in check-config.sh script
 
 * Tue Jan 31 2012 Jan Vcelak <jvcelak@redhat.com> 2.4.28-3
 - fix: replication (syncrepl) with TLS causes segfault (#783431)