diff --git a/libexec-functions b/libexec-functions
index 958c772..990d2b8 100644
--- a/libexec-functions
+++ b/libexec-functions
@@ -61,7 +61,7 @@ function uses_new_config()
 
 function run_as_ldap()
 {
-	/bin/su --shell /bin/sh --session-command "$1" "$SLAPD_USER"
+	/sbin/runuser --shell /bin/sh --session-command "$1" "$SLAPD_USER"
 	return $?
 }
 
diff --git a/openldap.spec b/openldap.spec
index 34b0844..56ea4a1 100644
--- a/openldap.spec
+++ b/openldap.spec
@@ -662,6 +662,7 @@ exit 0
   + generate server certificate using Mozilla NSS tools instead of OpenSSL tools
   + fix: correct path to check-config.sh in service file (Jan Synáček <jsynacek@redhat.com>)
 - temporarily disable certificates checking in check-config.sh script
+- fix: check-config.sh get stuck when executing command as a ldap user
 
 * Tue Jan 31 2012 Jan Vcelak <jvcelak@redhat.com> 2.4.28-3
 - fix: replication (syncrepl) with TLS causes segfault (#783431)