diff --git a/perl-IO-Socket-SSL.spec b/perl-IO-Socket-SSL.spec
index 6f3f63f..1a4ae65 100644
--- a/perl-IO-Socket-SSL.spec
+++ b/perl-IO-Socket-SSL.spec
@@ -1,5 +1,5 @@
 Name:		perl-IO-Socket-SSL
-Version:	1.967
+Version:	1.968
 Release:	1%{?dist}
 Summary:	Perl library for transparent SSL
 Group:		Development/Libraries
@@ -17,7 +17,7 @@ BuildRequires:	perl(ExtUtils::MakeMaker) >= 6.46
 BuildRequires:	perl(IO::Select)
 BuildRequires:	perl(IO::Socket)
 BuildRequires:	perl(IO::Socket::INET)
-BuildRequires:	perl(IO::Socket::INET6) >= 2.55
+BuildRequires:	perl(IO::Socket::INET6) >= 2.62
 BuildRequires:	perl(Net::LibIDN)
 BuildRequires:	perl(Net::SSLeay) >= 1.46
 BuildRequires:	perl(Scalar::Util)
@@ -30,7 +30,7 @@ BuildRequires:	procps
 BuildRequires:	perl(IO::Socket::IP) >= 0.20, perl(Socket) >= 1.95
 Requires:	perl(IO::Socket::IP) >= 0.20, perl(Socket) >= 1.95
 %else
-Requires:	perl(IO::Socket::INET6) >= 2.55, perl(Socket6)
+Requires:	perl(IO::Socket::INET6) >= 2.62, perl(Socket6)
 %endif
 Requires:	perl(:MODULE_COMPAT_%(eval "`perl -V:version`"; echo $version))
 Requires:	perl(Net::LibIDN)
@@ -49,7 +49,7 @@ mod_perl.
 %setup -q -n IO-Socket-SSL-%{version}
 
 %build
-perl Makefile.PL INSTALLDIRS=vendor
+echo n | perl Makefile.PL INSTALLDIRS=vendor
 make %{?_smp_mflags}
 
 %install
@@ -72,6 +72,21 @@ rm -rf %{buildroot}
 %{_mandir}/man3/IO::Socket::SSL::Utils.3pm*
 
 %changelog
+* Thu Mar 13 2014 Paul Howarth <paul@city-fan.org> - 1.968-1
+- Update to 1.968
+  - BEHAVIOR CHANGE: removed implicit defaults of certs/server-{cert,key}.pem
+    for SSL_{cert,key}_file and ca/,certs/my-ca.pem for SSL_ca_file; these
+    defaults were deprecated since 1.951 (July 2013)
+  - Usable CA verification path on Windows etc.:
+    - Do not use Net::SSLeay::CTX_set_default_verify_paths any longer to set
+      system/build dependent default verification path, because there was no
+      way to retrieve these default values and check if they contained usable
+      CA
+    - Instead, re-implement the same algorithm and export the results with
+      public function default_ca() and make it possible to overwrite it
+    - Also check for usable verification path during build; if no usable path
+      is detected, require Mozilla::CA at build and try to use it at runtime
+
 * Fri Feb  7 2014 Paul Howarth <paul@city-fan.org> - 1.967-1
 - Update to 1.967
   - Verify the hostname inside a certificate by default with a superset of
diff --git a/sources b/sources
index 5e1dad4..7190f67 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-78b84d50e5a04c19b1d3835514dece95  IO-Socket-SSL-1.967.tar.gz
+033e9e15406e7cd9071f1ebc51c90da9  IO-Socket-SSL-1.968.tar.gz