diff --git a/kdelibs-3.5.10-openssl.patch b/kdelibs-3.5.10-openssl.patch
index 399e8b7..c285ba9 100644
--- a/kdelibs-3.5.10-openssl.patch
+++ b/kdelibs-3.5.10-openssl.patch
@@ -1,10 +1,11 @@
 diff -up kdelibs-3.5.10/kio/kssl/kopenssl.cc.openssl kdelibs-3.5.10/kio/kssl/kopenssl.cc
 --- kdelibs-3.5.10/kio/kssl/kopenssl.cc.openssl	2006-07-22 03:16:39.000000000 -0500
 +++ kdelibs-3.5.10/kio/kssl/kopenssl.cc	2009-04-19 16:34:14.000000000 -0500
-@@ -329,6 +329,19 @@ KConfig *cfg;
+@@ -329,6 +329,20 @@ KConfig *cfg;
               #ifdef SHLIB_VERSION_NUMBER
               << "libssl.so." SHLIB_VERSION_NUMBER
               #endif
++             << "libssl.so.10"
 +             << "libssl.so.0.9.8k"
 +             << "libssl.so.8"
 +             << "libssl.so.0.9.8g"
@@ -21,10 +22,11 @@ diff -up kdelibs-3.5.10/kio/kssl/kopenssl.cc.openssl kdelibs-3.5.10/kio/kssl/kop
               << "libssl.so"
  	     << "libssl.so.0"
               #endif
-@@ -346,6 +359,19 @@ KConfig *cfg;
+@@ -346,6 +360,20 @@ KConfig *cfg;
               #ifdef SHLIB_VERSION_NUMBER
               << "libcrypto.so." SHLIB_VERSION_NUMBER
               #endif
++             << "libcrypto.so.10"
 +             << "libcrypto.so.0.9.8k"
 +             << "libcrypto.so.8"
 +             << "libcrypto.so.0.9.8g"
diff --git a/kdelibs3.spec b/kdelibs3.spec
index d112dfd..e61a65f 100644
--- a/kdelibs3.spec
+++ b/kdelibs3.spec
@@ -18,7 +18,7 @@
 Summary: KDE 3 Libraries
 Name:    kdelibs3
 Version: 3.5.10
-Release: 89%{?dist}
+Release: 90%{?dist}
 
 License: LGPLv2
 Url: http://www.kde.org/
@@ -141,6 +141,7 @@ Patch301: kde3-automake-version.patch
 # also add --force-missing to get aarch64 support (#925029/#925627)
 Patch302: kde3-automake-add-missing.patch
 
+Requires: ca-certificates
 Requires: hicolor-icon-theme
 Requires: kde-settings >= 3.5
 Requires: kde-filesystem
@@ -518,6 +519,14 @@ rm -fv %{buildroot}%{_datadir}/config/katesyntaxhighlightingrc
 # don't show kresources
 sed -i -e "s,^OnlyShowIn=KDE;,OnlyShowIn=KDE3;," %{buildroot}%{_datadir}/applications/kde/kresources.desktop 
 
+# use ca-certificates' ca-bundle.crt, symlink as what most other
+# distros do these days (http://bugzilla.redhat.com/521902)
+if [  -f %{buildroot}%{_datadir}/apps/kssl/ca-bundle.crt -a \
+      -f /etc/pki/tls/certs/ca-bundle.crt ]; then
+  ln -sf /etc/pki/tls/certs/ca-bundle.crt \
+         %{buildroot}%{_datadir}/apps/kssl/ca-bundle.crt
+fi
+
 
 %check
 ERROR=0
@@ -652,6 +661,10 @@ touch --no-create %{_datadir}/icons/crystalsvg 2> /dev/null || :
 %attr(4755,root,root) %{_bindir}/kpac_dhcp_helper
 
 %changelog
+* Thu Dec 28 2017 Yaakov Selkowitz <yselkowi@redhat.com> - 3.5.10-90
+- Fix loading of latest compat-openssl10 (#1529417)
+- Use ca-certificates' ca-bundle.crt (#521902)
+
 * Tue Aug 08 2017 Kevin Kofler <Kevin@tigcc.ticalc.org> - 3.5.10-89
 - fix libidn dependency removal from .la files (#1479146)