diff --git a/openwsman-2.6.8-ssl-certs-gen-changes.patch b/openwsman-2.6.8-ssl-certs-gen-changes.patch
new file mode 100644
index 0000000..a828806
--- /dev/null
+++ b/openwsman-2.6.8-ssl-certs-gen-changes.patch
@@ -0,0 +1,103 @@
+diff -up openwsman-2.6.8/etc/owsmangencert.sh.cmake.orig openwsman-2.6.8/etc/owsmangencert.sh.cmake
+--- openwsman-2.6.8/etc/owsmangencert.sh.cmake.orig	2025-10-14 10:05:22.966137046 +0200
++++ openwsman-2.6.8/etc/owsmangencert.sh.cmake	2025-10-14 10:09:39.142759545 +0200
+@@ -1,10 +1,74 @@
+-#!/bin/sh
+-
+ #!/bin/sh -e
+ 
+ CERTFILE=@WSMANCONF_DIR@/servercert.pem
+ KEYFILE=@WSMANCONF_DIR@/serverkey.pem
+ CNFFILE=@WSMANCONF_DIR@/ssleay.cnf
++CAFILE=@WSMANCONF_DIR@/ca.crt
++DAYS=365
++
++function create_ssl_cnf
++{
++    # Get minimum RSA key length at current security level
++    # This workarounds openssl not enforcing min. key length enforced by current security level
++    KEYSIZE=`grep min_rsa_size /etc/crypto-policies/state/CURRENT.pol | cut -d ' ' -f 3`
++
++    # Create OpenSSL configuration files for generating certificates
++    echo "[ req ]" > $CNFFILE
++    echo "default_bits            = $KEYSIZE" >> $CNFFILE
++    echo "default_keyfile         = privkey.pem" >> $CNFFILE
++    echo "distinguished_name      = req_distinguished_name" >> $CNFFILE
++
++    echo "[ req_distinguished_name ]" >> $CNFFILE
++    echo "countryName                     = Country Name (2 letter code)" >> $CNFFILE
++    echo "countryName_default             = GB" >> $CNFFILE
++    echo "countryName_min                 = 2" >> $CNFFILE
++    echo "countryName_max                 = 2" >> $CNFFILE
++
++    echo "stateOrProvinceName             = State or Province Name (full name)" >> $CNFFILE
++    echo "stateOrProvinceName_default     = Some-State" >> $CNFFILE
++
++    echo "localityName                    = Locality Name (eg, city)" >> $CNFFILE
++
++    echo "organizationName                = Organization Name (eg, company; recommended)" >> $CNFFILE
++    echo "organizationName_max            = 64" >> $CNFFILE
++
++    echo "organizationalUnitName          = Organizational Unit Name (eg, section)" >> $CNFFILE
++    echo "organizationalUnitName_max      = 64" >> $CNFFILE
++
++    echo "commonName                      = server name (eg. ssl.domain.tld; required!!!)" >> $CNFFILE
++    echo "commonName_max                  = 80" >> $CNFFILE
++
++    echo "emailAddress                    = Email Address" >> $CNFFILE
++    echo "emailAddress_max                = 85" >> $CNFFILE
++}
++
++function selfsign_sscg()
++{
++    sscg --quiet \
++         --lifetime "${DAYS}" \
++         --cert-key-file "${KEYFILE}" \
++         --cert-file "${CERTFILE}" \
++         --ca-file "${CAFILE}"
++}
++
++function selfsign_openssl()
++{
++
++    echo
++    echo creating selfsigned certificate
++    echo "replace it with one signed by a certification authority (CA)"
++    echo
++    echo enter your ServerName at the Common Name prompt
++    echo
++
++    # use special .cnf, because with normal one no valid selfsigned
++    # certificate is created
++
++    openssl req -days $DAYS $@ -config $CNFFILE \
++        -new -x509 -nodes -out $CERTFILE \
++        -keyout $KEYFILE
++    chmod 600 $KEYFILE
++}
+ 
+ if [ "$1" != "--force" -a -f $KEYFILE ]; then
+   echo "$KEYFILE exists!  Use \"$0 --force.\""
+@@ -15,19 +79,7 @@ if [ "$1" = "--force" ]; then
+   shift
+ fi
+ 
+-echo
+-echo creating selfsigned certificate
+-echo "replace it with one signed by a certification authority (CA)"
+-echo
+-echo enter your ServerName at the Common Name prompt
+-echo
+-
+-# use special .cnf, because with normal one no valid selfsigned
+-# certificate is created
+-
+-export RANDFILE=/dev/random
+-openssl req -days 365 $@ -config $CNFFILE \
+-  -new -x509 -nodes -out $CERTFILE \
+-  -keyout $KEYFILE
+-chmod 600 $KEYFILE
++create_ssl_cnf
+ 
++# If sscg fails, try openssl
++selfsign_sscg || selfsign_openssl
diff --git a/openwsman.spec b/openwsman.spec
index 4ead52e..03b2be9 100644
--- a/openwsman.spec
+++ b/openwsman.spec
@@ -3,7 +3,7 @@
 
 Name:		openwsman
 Version:	2.6.8
-Release:	23%{?dist}
+Release:	24%{?dist}
 Summary:	Open source Implementation of WS-Management
 
 License:	BSD
@@ -24,6 +24,7 @@ Patch6:		openwsman-2.6.8-CVE-2019-3816.patch
 Patch7:		openwsman-2.6.8-CVE-2019-3833.patch
 Patch8:		openwsman-2.6.8-update-ssleay-conf.patch
 Patch9:		openwsman-2.6.8-http-unauthorized-improve.patch
+Patch10:	openwsman-2.6.8-ssl-certs-gen-changes.patch
 BuildRequires: make
 BuildRequires:	swig
 BuildRequires:	libcurl-devel libxml2-devel pam-devel sblim-sfcc-devel
@@ -137,6 +138,7 @@ You can use it to send shell commands to a remote Windows hosts.
 %patch -P7 -p1 -b .CVE-2019-3833
 %patch -P8 -p1 -b .update-ssleay-conf
 %patch -P9 -p1 -b .http-unauthorized-improve
+%patch -P10 -p1 -b .ssl-certs-gen-changes
 
 %build
 # Removing executable permissions on .c and .h files to fix rpmlint warnings. 
@@ -290,6 +292,10 @@ rm -f /var/log/wsmand.log
 %{_bindir}/winrs
 
 %changelog
+* Tue Oct 14 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.6.8-24
+- Update OpenSSL certificates set up
+  Resolves: RHEL-118292
+
 * Thu Nov 24 2022 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.6.8-23
 - Improve handling of HTTP 401 Unauthorized
   Resolves: #2127415