diff --git a/mingw-openssl.spec b/mingw-openssl.spec
index 6e32300..c4c0249 100644
--- a/mingw-openssl.spec
+++ b/mingw-openssl.spec
@@ -174,7 +174,7 @@ Static version of the MinGW port of the OpenSSL toolkit.
 %patch25 -p1 -b .manfix
 
 %patch32 -p1 -b .ia64
-#patch33 is applied after make test
+%patch33 -p1 -b .ca-dir
 %patch34 -p1 -b .x509
 %patch35 -p1 -b .version-add-engines
 %patch38 -p1 -b .cipher-change
@@ -235,10 +235,19 @@ make all build-shared
 # Generate hashes for the included certs.
 make rehash build-shared
 
+if ! iconv -f UTF-8 -t ASCII//TRANSLIT CHANGES >/dev/null 2>&1 ; then
+  iconv -f ISO-8859-1 -t UTF-8 -o CHANGES.utf8 CHANGES && \
+    mv -f CHANGES.utf8 CHANGES
+fi
+
+
 %if %{run_tests}
+%check
 #----------------------------------------------------------------------
-# Run some tests.  I don't know why this isn't in a %-check section
-# but this is how it is in the native RPM.
+# Run some tests.
+
+# We must revert patch33 before tests otherwise they will fail
+patch -p1 -R < %{PATCH33}
 
 # This is a bit of a hack, but the test scripts look for 'openssl'
 # by name.
@@ -286,9 +295,6 @@ make LDCMD=%{mingw32_cc} -C test apps tests
 #----------------------------------------------------------------------
 %endif
 
-# Patch33 must be patched after tests otherwise they will fail
-patch -p1 -b -z .ca-dir < %{PATCH33}
-
 # Add generation of HMAC checksum of the final stripped library
 ##define __spec_install_post \
 #    #{?__debug_package:#{__debug_install_post}} \
@@ -298,11 +304,6 @@ patch -p1 -b -z .ca-dir < %{PATCH33}
 #    ln -sf .libcrypto.so.#{version}.hmac $RPM_BUILD_ROOT/#{_lib}/.libcrypto.so.#{soversion}.hmac \
 ##{nil}
 
-if ! iconv -f UTF-8 -t ASCII//TRANSLIT CHANGES >/dev/null 2>&1 ; then
-  iconv -f ISO-8859-1 -t UTF-8 -o CHANGES.utf8 CHANGES && \
-    mv -f CHANGES.utf8 CHANGES
-fi
-
 
 %install
 mkdir -p $RPM_BUILD_ROOT%{mingw32_libdir}