diff --git a/.gitignore b/.gitignore
index 501d9c6..1fe60ea 100644
--- a/.gitignore
+++ b/.gitignore
@@ -51,3 +51,5 @@
 /freeipa-4.4.4.tar.gz.asc
 /freeipa-4.5.1.tar.gz
 /freeipa-4.5.1.tar.gz.asc
+/freeipa-4.5.2.tar.gz
+/freeipa-4.5.2.tar.gz.asc
diff --git a/freeipa.spec b/freeipa.spec
index 8e5f5f5..9ab7b55 100644
--- a/freeipa.spec
+++ b/freeipa.spec
@@ -63,7 +63,7 @@
 %global etc_systemd_dir %{_sysconfdir}/systemd/system
 %global gettext_domain ipa
 
-%global VERSION 4.5.1
+%global VERSION 4.5.2
 
 %define _hardened_build 1
 
@@ -163,8 +163,8 @@ BuildRequires:  python3-wheel
 %if 0%{?with_lint}
 BuildRequires:  samba-python
 # 1.4: the version where Certificate.serial changed to .serial_number
-BuildRequires:  python-cryptography >= 1.4
-BuildRequires:  python-gssapi >= 1.2.0
+BuildRequires:  python2-cryptography >= 1.4
+BuildRequires:  python-gssapi >= 1.2.0-5
 BuildRequires:  pylint >= 1.6
 # workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1096506
 BuildRequires:  python2-polib
@@ -182,7 +182,7 @@ BuildRequires:  python-pytest-multihost
 BuildRequires:  python-pytest-sourceorder
 BuildRequires:  python-jwcrypto
 # 0.3: sd_notify (https://pagure.io/freeipa/issue/5825)
-BuildRequires:  python-custodia >= 0.3.1
+BuildRequires:  python2-custodia >= 0.3.1
 BuildRequires:  dbus-python
 BuildRequires:  python-dateutil
 BuildRequires:  python-enum34
@@ -281,7 +281,7 @@ Requires: mod_session
 # 0.9.9: https://github.com/adelton/mod_lookup_identity/pull/3
 Requires: mod_lookup_identity >= 0.9.9
 Requires: python-ldap >= 2.4.15
-Requires: python-gssapi >= 1.2.0
+Requires: python-gssapi >= 1.2.0-5
 Requires: acl
 Requires: systemd-units >= 38
 Requires(pre): shadow-utils
@@ -345,10 +345,10 @@ BuildArch: noarch
 Requires: %{name}-server-common = %{version}-%{release}
 Requires: %{name}-common = %{version}-%{release}
 Requires: python2-ipaclient = %{version}-%{release}
-Requires: python-custodia >= 0.3.1
+Requires: python2-custodia >= 0.3.1
 Requires: python-ldap >= 2.4.15
 Requires: python-lxml
-Requires: python-gssapi >= 1.2.0
+Requires: python-gssapi >= 1.2.0-5
 Requires: python-sssdconfig
 Requires: python-pyasn1
 Requires: dbus-python
@@ -501,7 +501,7 @@ Requires: certmonger >= 0.78
 Requires: nss-tools
 Requires: bind-utils
 Requires: oddjob-mkhomedir
-Requires: python-gssapi >= 1.2.0
+Requires: python-gssapi >= 1.2.0-5
 Requires: libsss_autofs
 Requires: autofs
 Requires: libnfsidmap
@@ -638,14 +638,14 @@ Provides: python2-ipaplatform = %{version}-%{release}
 %{?python_provide:%python_provide python2-ipaplatform}
 %{!?python_provide:Provides: python-ipaplatform = %{version}-%{release}}
 Requires: %{name}-common = %{version}-%{release}
-Requires: python-gssapi >= 1.2.0
+Requires: python-gssapi >= 1.2.0-5
 Requires: gnupg
 Requires: keyutils
 Requires: pyOpenSSL
 Requires: python >= 2.7.9
 Requires: python-nss >= 0.16
 Requires: m2crypto
-Requires: python-cryptography >= 1.4
+Requires: python2-cryptography >= 1.4
 Requires: python-netaddr >= %{python_netaddr_version}
 Requires: python-libipa_hbac
 Requires: python-qrcode-core >= 5.0.0
@@ -1217,6 +1217,7 @@ fi
 %{_sbindir}/ipa-advise
 %{_sbindir}/ipa-cacert-manage
 %{_sbindir}/ipa-winsync-migrate
+%{_sbindir}/ipa-pkinit-manage
 %{_libexecdir}/certmonger/dogtag-ipa-ca-renew-agent-submit
 %{_libexecdir}/certmonger/ipa-server-guard
 %dir %{_libexecdir}/ipa
@@ -1280,6 +1281,7 @@ fi
 %{_mandir}/man1/ipa-otptoken-import.1*
 %{_mandir}/man1/ipa-cacert-manage.1*
 %{_mandir}/man1/ipa-winsync-migrate.1*
+%{_mandir}/man1/ipa-pkinit-manage.1*
 
 
 %files -n python2-ipaserver
@@ -1454,6 +1456,7 @@ fi
 %{python_sitelib}/ipaclient/plugins/*.py*
 %dir %{python_sitelib}/ipaclient/remote_plugins
 %{python_sitelib}/ipaclient/remote_plugins/*.py*
+%dir %{python_sitelib}/ipaclient/remote_plugins/2_*
 %{python_sitelib}/ipaclient/remote_plugins/2_*/*.py*
 %dir %{python_sitelib}/ipaclient/csrgen
 %dir %{python_sitelib}/ipaclient/csrgen/profiles
@@ -1483,6 +1486,7 @@ fi
 %dir %{python3_sitelib}/ipaclient/remote_plugins
 %{python3_sitelib}/ipaclient/remote_plugins/*.py
 %{python3_sitelib}/ipaclient/remote_plugins/__pycache__/*.py*
+%dir %{python3_sitelib}/ipaclient/remote_plugins/2_*
 %{python3_sitelib}/ipaclient/remote_plugins/2_*/*.py
 %{python3_sitelib}/ipaclient/remote_plugins/2_*/__pycache__/*.py*
 %dir %{python3_sitelib}/ipaclient/csrgen
@@ -1606,6 +1610,9 @@ fi
 %endif # with_ipatests
 
 %changelog
+* Sun Jun 18 2017 Tomas Krizek <tkrizek@redhat.com> - 4.5.2-1
+- Update to upstream 4.5.2 - see https://www.freeipa.org/page/Releases/4.5.2
+
 * Thu May 25 2017 Tomas Krizek <tkrizek@redhat.com> - 4.5.1-1
 - Update to upstream 4.5.1 - see https://www.freeipa.org/page/Releases/4.5.1
 - Fixes #1168266 UI drops "Enknown Error" when the ipa record in /etc/hosts changes
diff --git a/sources b/sources
index 6f3e2b0..3320079 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (freeipa-4.5.1.tar.gz) = d9579a57724384bdbcc264d9749e66e31a49c243c514444819d61f3f687d65ce2e4552c8c1222283cbe16c6fd0e184887ab707752ca1c38e9ebe3a073e3c5a2b
-SHA512 (freeipa-4.5.1.tar.gz.asc) = 9cde8cd9ee65e4cdbf9bbfd7acf7c712e07f547c34e1fc0576ba7aa3cc07a0bd1a35b774a6d8ebba715a5e366002c76ffa5eacbdab2982aca2af59464d79d670
+SHA512 (freeipa-4.5.2.tar.gz) = 0525f3b614f3837dd4fc2c459115d4765254caed88345c8f2e6014942ff9ccfe0f865d14bb7444260fca2c8db306fcc9df5ccf87cf0e3565fb0b304a5e5b379d
+SHA512 (freeipa-4.5.2.tar.gz.asc) = 38a760516817dded90f46fc9cb4e0a9c548591a544f4b8e6d6ba9c1f7b7abed196d08c66221b0ae8c4b1d72a1ed6ee891ad96f3b5c0ec3bb536f92930d7738d0