diff --git a/0004-certmap-mention-special-regex-characters-in-man-page.patch b/0004-certmap-mention-special-regex-characters-in-man-page.patch
new file mode 100644
index 0000000..1eee827
--- /dev/null
+++ b/0004-certmap-mention-special-regex-characters-in-man-page.patch
@@ -0,0 +1,42 @@
+From 21cb9fb28db1f2eb4ee770eb029bfe20233e4392 Mon Sep 17 00:00:00 2001
+From: Sumit Bose <sbose@redhat.com>
+Date: Thu, 12 Dec 2019 13:10:16 +0100
+Subject: [PATCH] certmap: mention special regex characters in man page
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Since some of the matching rules use regular expressions some characters
+must be escaped so that they can be used a ordinary characters in the
+rules.
+
+Related to https://pagure.io/SSSD/sssd/issue/4127
+
+Reviewed-by: Michal Židek <mzidek@redhat.com>
+---
+ src/man/sss-certmap.5.xml | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/src/man/sss-certmap.5.xml b/src/man/sss-certmap.5.xml
+index db258d14a..10343625e 100644
+--- a/src/man/sss-certmap.5.xml
++++ b/src/man/sss-certmap.5.xml
+@@ -92,6 +92,15 @@
+                     <para>
+                         Example: &lt;SUBJECT&gt;.*,DC=MY,DC=DOMAIN
+                     </para>
++                    <para>
++                        Please note that the characters "^.[$()|*+?{\" have a
++                        special meaning in regular expressions and must be
++                        escaped with the help of the '\' character so that they
++                        are matched as ordinary characters.
++                    </para>
++                    <para>
++                        Example: &lt;SUBJECT&gt;^CN=.* \(Admin\),DC=MY,DC=DOMAIN$
++                    </para>
+                     </listitem>
+                 </varlistentry>
+                 <varlistentry>
+-- 
+2.20.1
+
diff --git a/sssd.spec b/sssd.spec
index 120d0c1..10e58bf 100644
--- a/sssd.spec
+++ b/sssd.spec
@@ -36,7 +36,7 @@
 
 Name: sssd
 Version: 2.2.3
-Release: 2%{?dist}
+Release: 3%{?dist}
 Summary: System Security Services Daemon
 License: GPLv3+
 URL: https://pagure.io/SSSD/sssd/
@@ -46,6 +46,7 @@ Source0: https://releases.pagure.org/SSSD/sssd/%{name}-%{version}.tar.gz
 Patch0001: 0001-Fix-build-failure-against-samba-4.12.0rc1.patch
 Patch0002: 0002-BUILD-Accept-krb5-1.18-for-building-the-PAC-plugin.patch
 Patch0003: 0003-INI-sssctl-config-check-command-error-messages.patch
+Patch0004: 0004-certmap-mention-special-regex-characters-in-man-page.patch
 
 ### Downstream only patches ###
 Patch0502: 0502-SYSTEMD-Use-capabilities.patch
@@ -1074,6 +1075,10 @@ fi
                                 %{_libdir}/%{name}/modules/libwbclient.so
 
 %changelog
+* Wed Feb 26 2020 Michal Židek <mzidek@redhat.com> - 2.2.3-3
+- Resolves: upstream#4127 - [Doc]Provide explanation on escape character for
+                            match rules sss-certmap
+
 * Wed Feb 26 2020 Michal Židek <mzidek@redhat.com> - 2.2.3-2
 - Resolves: upstream#4129 - sssctl config-check command does not give proper
                             error messages with line numbers