diff --git a/0063-test_ca-add-empty-index.txt.attr-file.patch b/0063-test_ca-add-empty-index.txt.attr-file.patch
new file mode 100644
index 0000000..72c9145
--- /dev/null
+++ b/0063-test_ca-add-empty-index.txt.attr-file.patch
@@ -0,0 +1,42 @@
+From f6d3289ca95bcaca68647f0db76c100d616679bc Mon Sep 17 00:00:00 2001
+From: Sumit Bose <sbose@redhat.com>
+Date: Wed, 14 Mar 2018 15:15:19 +0100
+Subject: [PATCH] test_ca: add empty index.txt.attr file
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Although is does not harm because 'openssl ca' creates the
+index.tx.tattr file with a suitable content automatically this patch
+adds the file to the test_CA directory to silence a message like:
+
+Can't open ./index.txt.attr for reading, No such file or directory
+139867607979840:error:02001002:system library:fopen:No such file or
+directory:crypto/bio/bss_file.c:74:fopen('./index.txt.attr','r')
+139867607979840:error:2006D080:BIO routines:BIO_new_file:no such
+file:crypto/bio/bss_file.c:81:
+
+which is show by recent versions of OpenSSL.
+
+Related to https://pagure.io/SSSD/sssd/issue/3436
+
+Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
+(cherry picked from commit 86c06c3b3d1cb4f590bcd951939bf3ef0001c4d3)
+---
+ src/tests/test_CA/Makefile.am | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/tests/test_CA/Makefile.am b/src/tests/test_CA/Makefile.am
+index a23a3feef..bfcd908e3 100644
+--- a/src/tests/test_CA/Makefile.am
++++ b/src/tests/test_CA/Makefile.am
+@@ -89,5 +89,6 @@ clean-local:
+ 
+ serial: clean
+ 	touch index.txt
++	touch index.txt.attr
+ 	mkdir newcerts
+ 	echo -n 01 > serial
+-- 
+2.17.0
+
diff --git a/sssd.spec b/sssd.spec
index 845a526..097e729 100644
--- a/sssd.spec
+++ b/sssd.spec
@@ -34,7 +34,7 @@
 
 Name: sssd
 Version: 1.16.1
-Release: 6%{?dist}
+Release: 7%{?dist}
 Group: Applications/System
 Summary: System Security Services Daemon
 License: GPLv3+
@@ -104,6 +104,7 @@ Patch0059: 0059-Do-not-keep-allocating-external-groups-on-a-long-liv.patch
 Patch0060: 0060-CACHE_REQ-Do-not-fail-the-domain-locator-plugin-if-I.patch
 Patch0061: 0061-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch
 Patch0062: 0062-SYSDB-Properly-handle-name-gid-override-when-using-d.patch
+Patch0063: 0063-test_ca-add-empty-index.txt.attr-file.patch
 
 Patch0502: 0502-SYSTEMD-Use-capabilities.patch
 Patch0503: 0503-Disable-stopping-idle-socket-activated-responders.patch
@@ -1308,6 +1309,10 @@ fi
                                 %{_libdir}/%{name}/modules/libwbclient.so
 
 %changelog
+* Wed May 16 2018 Fabiano Fidêncio <fidencio@fedoraproject.org> - 1.16.1-7
+- Related: upstream#3436 - Certificates used in unit tests have limited
+                           lifetime
+
 * Mon May 14 2018 Fabiano Fidêncio <fidencio@fedoraproject.org> - 1.16.1-6
 - Related: upstream#3436 - Add openssl, openssh and nss-tools as BuildRequires