diff --git a/.gitignore b/.gitignore
index 094cc59..85e1a3e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,3 +9,5 @@ TestUser50.cert
 TestUser51.cert
 /nss-pem-20140125.tar.bz2
 /nss-3.18.0.tar.gz
+/PayPalRootCA.cert
+/PayPalICA.cert
diff --git a/nss-moz-1151037.patch b/nss-moz-1151037.patch
new file mode 100644
index 0000000..8910d91
--- /dev/null
+++ b/nss-moz-1151037.patch
@@ -0,0 +1,29 @@
+diff --git a/tests/chains/scenarios/realcerts.cfg b/tests/chains/scenarios/realcerts.cfg
+--- a/tests/chains/scenarios/realcerts.cfg
++++ b/tests/chains/scenarios/realcerts.cfg
+@@ -16,14 +16,14 @@ import BrAirWaysBadSig:x:
+ 
+ verify TestUser50:x
+   result pass
+ 
+ verify TestUser51:x
+   result pass
+ 
+ verify PayPalEE:x
+-  policy OID.2.16.840.1.113733.1.7.23.6 
++  policy OID.2.16.840.1.114412.1.1 
+   result pass
+ 
+ verify BrAirWaysBadSig:x
+   result fail
+ 
+diff --git a/tests/libpkix/vfychain_test.lst b/tests/libpkix/vfychain_test.lst
+--- a/tests/libpkix/vfychain_test.lst
++++ b/tests/libpkix/vfychain_test.lst
+@@ -1,4 +1,4 @@
+ # Status | Leaf Cert | Policies | Others(undef)
+ 0 TestUser50 undef
+ 0 TestUser51 undef
+-0 PayPalEE OID.2.16.840.1.113733.1.7.23.6
++0 PayPalEE OID.2.16.840.1.114412.1.1
+
diff --git a/nss.spec b/nss.spec
index f51fc60..6e0e852 100644
--- a/nss.spec
+++ b/nss.spec
@@ -19,7 +19,7 @@
 Summary:          Network Security Services
 Name:             nss
 Version:          3.18.0
-Release:          1%{?dist}
+Release:          2%{?dist}
 License:          MPLv2.0
 URL:              http://www.mozilla.org/projects/security/pki/nss/
 Group:            System Environment/Libraries
@@ -58,6 +58,8 @@ Source8:          system-pkcs11.txt
 Source9:          setup-nsssysinit.sh
 Source10:         PayPalEE.cert
 Source12:         %{name}-pem-20140125.tar.bz2
+Source13:         PayPalICA.cert
+Source14:         PayPalRootCA.cert
 Source17:         TestCA.ca.cert
 Source18:         TestUser50.cert
 Source19:         TestUser51.cert
@@ -92,6 +94,8 @@ Patch49:          nss-skip-bltest-and-fipstest.patch
 Patch50:          iquote.patch
 Patch52:          disableSSL2libssl.patch
 Patch53:          disableSSL2tests.patch
+# fix upstream bug 1151037, until we rebase to 3.19
+Patch60:          nss-moz-1151037.patch
 
 %description
 Network Security Services (NSS) is a set of libraries designed to
@@ -163,6 +167,8 @@ low level services.
 %prep
 %setup -q
 %{__cp} %{SOURCE10} -f ./nss/tests/libpkix/certs
+%{__cp} %{SOURCE13} -f ./nss/tests/libpkix/certs
+%{__cp} %{SOURCE14} -f ./nss/tests/libpkix/certs
 %{__cp} %{SOURCE17} -f ./nss/tests/libpkix/certs
 %{__cp} %{SOURCE18} -f ./nss/tests/libpkix/certs
 %{__cp} %{SOURCE19} -f ./nss/tests/libpkix/certs
@@ -181,6 +187,7 @@ low level services.
 pushd nss
 %patch52 -p1 -b .disableSSL2libssl
 %patch53 -p1 -b .disableSSL2tests
+%patch60 -p1 -b .testcert-1151037
 popd
 
 #########################################################
@@ -788,6 +795,9 @@ fi
 
 
 %changelog
+* Fri May 15 2015 Kai Engert <kaie@redhat.com> - 3.18.0-2
+- Replace expired test certificates, upstream bug 1151037
+
 * Thu Mar 19 2015 Elio Maldonado <emaldona@redhat.com> - 3.18.0-1
 - Update to nss-3.18.0
 - Resolves: Bug 1203689 - nss-3.18 is available
diff --git a/sources b/sources
index 8d12cb6..3460ca6 100644
--- a/sources
+++ b/sources
@@ -3,9 +3,11 @@ a5ae49867124ac75f029a9a33af31bad  blank-cert8.db
 73bc040a0542bba387e6dd7fb9fd7d23  blank-secmod.db
 691e663ccc07b7a1eaa6f088e03bf8e2  blank-cert9.db
 2ec9e0606ba40fe65196545564b7cc2a  blank-key4.db
-c9fefa97dc184a5857f12d938517ed81  PayPalEE.cert
 f998b70c1be25e8bb9f5fdb5d50eb6f2  TestCA.ca.cert
 1b7b6808cd77d5df29bf5bb9e5fac967  TestUser50.cert
 ab0b56dd505a995425c03e5266f7c8d6  TestUser51.cert
 b8a94e863c852e1f8b75e930e76f8640  nss-pem-20140125.tar.bz2
 a21659f999a3b27c2bc69a7d0bbba2cc  nss-3.18.0.tar.gz
+d4e4e93320bdbb4da823de44ea850b7b  PayPalEE.cert
+d474de575c39b2d39c8583c5c065498a  PayPalRootCA.cert
+aaee5cf8b0d8596d2e0cbe67421cf7db  PayPalICA.cert