diff --git a/cyrus-imapd-2.3.16-nodenny.patch b/cyrus-imapd-2.3.16-nodenny.patch
new file mode 100644
index 0000000..e91579d
--- /dev/null
+++ b/cyrus-imapd-2.3.16-nodenny.patch
@@ -0,0 +1,26 @@
+diff -up cyrus-imapd-2.3.16/imap/global.c.nodenny cyrus-imapd-2.3.16/imap/global.c
+--- cyrus-imapd-2.3.16/imap/global.c.nodenny	2009-10-13 17:10:36.000000000 +0200
++++ cyrus-imapd-2.3.16/imap/global.c	2010-01-14 14:00:10.455808186 +0100
+@@ -542,14 +542,22 @@ static int acl_ok(const char *user, stru
+ int access_ok(const char *user, const char *service, char *msgbuf, int size)
+ {
+     static char *fname = NULL;
++    static int nodb = 0;
+     struct db *db = NULL;
+     int r, ret = 1;  /* access always granted by default */
+ 
++    if (nodb) return ret;
++
+     if (!fname) {
++	struct stat s;
+ 	/* create path to database */
+ 	fname = xmalloc(strlen(config_dir) + sizeof(FNAME_USERDENYDB) + 1);
+ 	strcpy(fname, config_dir);
+ 	strcat(fname, FNAME_USERDENYDB);
++	if (stat(fname, &s) == -1 && errno==ENOENT) {
++	    nodb = 1;
++	    return ret;
++	}
+     }
+ 
+     /* try to open database */
diff --git a/cyrus-imapd.imap-2.3.x-conf b/cyrus-imapd.imap-2.3.x-conf
index 1d2f16a..2579793 100644
--- a/cyrus-imapd.imap-2.3.x-conf
+++ b/cyrus-imapd.imap-2.3.x-conf
@@ -6,6 +6,6 @@ sendmail: /usr/sbin/sendmail
 hashimapspool: true
 sasl_pwcheck_method: saslauthd
 sasl_mech_list: PLAIN
-tls_cert_file: /usr/share/ssl/certs/cyrus-imapd.pem
-tls_key_file: /usr/share/ssl/certs/cyrus-imapd.pem
-tls_ca_file: /usr/share/ssl/certs/ca-bundle.crt
+tls_cert_file: /etc/pki/cyrus-imapd/cyrus-imapd.pem
+tls_key_file: /etc/pki/cyrus-imapd/cyrus-imapd.pem
+tls_ca_file: /etc/pki/tls/certs/ca-bundle.crt
diff --git a/cyrus-imapd.spec b/cyrus-imapd.spec
index c7630d5..ba6301f 100644
--- a/cyrus-imapd.spec
+++ b/cyrus-imapd.spec
@@ -2,7 +2,7 @@
 
 Name: cyrus-imapd
 Version: 2.3.16
-Release: 1%{?dist}
+Release: 2%{?dist}
 
 %define ssl_pem_file %{_sysconfdir}/pki/%{name}/%{name}.pem
 
@@ -59,6 +59,9 @@ Patch18: cyrus-imapd-2.3.7-krb4.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=461875
 Patch19: cyrus-imapd-2.3.12p2-current-db.patch
 
+# workaround, rhbz#553011
+Patch20: cyrus-imapd-2.3.16-nodenny.patch
+
 BuildRoot: %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
 
 BuildRequires: autoconf
@@ -147,6 +150,7 @@ one running the server.
 %patch15 -p1 -b .make_md5_defaults
 %patch18 -p1 -b .krb4
 %patch19 -p1 -b .db4.7
+%patch20 -p1 -b .nodenny
 
 # add additional sources
 mkdir doc/{m4,contrib}
@@ -513,6 +517,10 @@ fi
 %{_mandir}/man1/*
 
 %changelog
+* Thu Jan 14 2010 Michal Hlavinka <mhlavink@redhat.com> - 2.3.16-2
+- ignore user_denny.db if missing (#553011)
+- fix location of certificates in default imapd.conf
+
 * Tue Dec 22 2009 Michal Hlavinka <mhlavink@redhat.com> - 2.3.16-1
 - updated to 2.3.16