diff --git a/.gitignore b/.gitignore
index f136c43..4e01a9f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -17,3 +17,4 @@ ldns-1.6.6.tar.gz
 /ldns-1.6.11.tar.gz
 /ldns-1.6.12.tar.gz
 /ldns-1.6.13.tar.gz
+/ldns-1.6.14.tar.gz
diff --git a/ldns.spec b/ldns.spec
index 9d0527e..c926133 100644
--- a/ldns.spec
+++ b/ldns.spec
@@ -7,20 +7,19 @@
 
 Summary: Lowlevel DNS(SEC) library with API
 Name: ldns
-Version: 1.6.13
-Release: 2%{?dist}
+Version: 1.6.14
+Release: 1%{?dist}
 License: BSD
 Url: http://www.nlnetlabs.nl/%{name}/
 Source: http://www.nlnetlabs.nl/downloads/%{name}/%{name}-%{version}.tar.gz
-Patch1:ldns-1.6.13-readzone.patch
 Group: System Environment/Libraries
-BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildRequires: perl, libpcap-devel, openssl-devel, gcc-c++, doxygen,
 # for snapshots only
 # BuildRequires: libtool, autoconf, automake
 %if %{with_python}
 BuildRequires:  python-devel, swig
 %endif
+Requires: ca-certificates
 
 %description
 ldns is a library with the aim to simplify DNS programming in C. All
@@ -53,17 +52,23 @@ Python extensions for ldns
 # aclocal
 # libtoolize -c --install
 # autoreconf --install
-%patch1 -p1 
 
 %build
 # as long as ECC is banned we cannot enable GOST or ECDSA
 %configure --disable-rpath --disable-static --disable-gost --disable-ecdsa \
+ --with-ca-file=/etc/pki/tls/certs/ca-bundle.trust.crt --with-ca-path=/etc/pki/tls/certs/ \
 %if %{with_python}
  --with-pyldns
 %endif
 
-(cd drill ; %configure --disable-rpath --disable-static --disable-gost --disable-ecdsa --with-ldns=%{buildroot}/lib/ )
-(cd examples ; %configure --disable-rpath --disable-static --disable-gost --disable-ecdsa --with-ldns=%{buildroot}/lib/ )
+(cd drill ; %configure --disable-rpath --disable-static --disable-gost \
+   --disable-ecdsa --with-ldns=%{buildroot}/lib/ \
+   --with-ca-file=/etc/pki/tls/certs/ca-bundle.trust.crt --with-ca-path=/etc/pki/tls/certs/
+)
+(cd examples ; %configure --disable-rpath --disable-static --disable-gost \
+   --disable-ecdsa --with-ldns=%{buildroot}/lib/  \
+   --with-ca-file=/etc/pki/tls/certs/ca-bundle.trust.crt --with-ca-path=/etc/pki/tls/certs/
+)
 
 make %{?_smp_mflags} 
 ( cd drill ; make %{?_smp_mflags} )
@@ -118,6 +123,11 @@ rm -rf %{buildroot}
 %postun -p /sbin/ldconfig
 
 %changelog
+* Tue Oct 23 2012 Paul Wouters <pwouters@redhat.com> - 1.6.14-1
+- Updated to 1.6.14
+- Removed merged in patch
+- Added new dependancy on ca-certificates for ldns-dane PKIX validation
+
 * Fri Jun 01 2012 Paul Wouters <pwouters@redhat.com> - 1.6.13-2
 - Added reworked ldns-read-zone patch from trunk
   (adds -p for SOA padding, and -o for zeroizing timestamps/sigs)
diff --git a/sources b/sources
index 32cffb6..1295c02 100644
--- a/sources
+++ b/sources
@@ -1 +1,2 @@
 bcada4f2e62aa40fcdd5d73aec46f284  ldns-1.6.13.tar.gz
+013dfd1c8725c707bbb5bcf70dbee2ff  ldns-1.6.14.tar.gz