diff --git a/.gitignore b/.gitignore
index 33eef1a..5b2652b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-SOURCES/pki-10.10.2.tar.gz
+SOURCES/pki-10.10.3.tar.gz
diff --git a/.pki-core.metadata b/.pki-core.metadata
index 35bd0c0..a0d0f37 100644
--- a/.pki-core.metadata
+++ b/.pki-core.metadata
@@ -1 +1 @@
-15e1bd559f7e22c25dd7fc4c546a7b344a1713a5 SOURCES/pki-10.10.2.tar.gz
+273f89c8c205f97a583d2e189a845d4cdc30065f SOURCES/pki-10.10.3.tar.gz
diff --git a/SPECS/pki-core.spec b/SPECS/pki-core.spec
index 52266fa..73f5d6e 100644
--- a/SPECS/pki-core.spec
+++ b/SPECS/pki-core.spec
@@ -12,7 +12,7 @@ License: GPLv2 and LGPLv2
# For development (i.e. unsupported) releases, use x.y.z-0.n.<phase>.
# For official (i.e. supported) releases, use x.y.z-r where r >=1.
-Version: 10.10.2
+Version: 10.10.3
Release: 1%{?_timestamp}%{?_commit_id}%{?dist}
#global _phase -beta1
@@ -236,7 +236,7 @@ BuildRequires: python3-pytest-runner
BuildRequires: junit
BuildRequires: jpackage-utils >= 0:1.7.5-10
-BuildRequires: jss >= 4.8.0
+BuildRequires: jss >= 4.8.1
BuildRequires: tomcatjss >= 7.6.1
# JNA is used to bind to libsystemd
@@ -412,6 +412,7 @@ Provides: pki-base-python3 = %{version}
Requires: pki-base = %{version}-%{release}
Requires: python3 >= 3.5
Requires: python3-cryptography
+Requires: python3-ldap
Requires: python3-lxml
Requires: python3-nss
Requires: python3-requests >= 2.6.0
@@ -510,7 +511,6 @@ Requires: keyutils
Requires: policycoreutils-python-utils
-Requires: python3-ldap
Requires: python3-lxml
Requires: python3-libselinux
Requires: python3-policycoreutils
@@ -1399,58 +1399,65 @@ fi
################################################################################
%changelog
+* Thu Jan 14 2021 Red Hat PKI Team <rhcs-maint@redhat.com> 10.10.3-1
+- Rebase to PKI 10.10.3
+- Bug 1584550 - CRMFPopClient: unexpected behavior with -y option when values are specified
+- Bug 1590942 - CMCResponse treats -d as optional
+- Bug 1664435 - Error instantiating class for challenge_password with SCEP request
+- Bug 1890639 - Two-step installation with external certificates fails on HSM configured system
+- Bug 1912493 - pkispawn reports incorrect FIPS mode
+
* Tue Dec 08 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.10.2-1
- Rebase to PKI 10.10.2
-- Bug #1392616 - KRA key recovery cli kra-key-retrieve generates an invalid p12 file
-- Bug #1890639 - Two-step installation with external certificates fails on HSM configured system
-- Bug #1897120 - pki-server cert-fix command failing
-- Bug #1694664 - ipa: ERROR: Certificate operation cannot be completed: Unable to communicate with CMS (503)
+- Bug 1392616 - KRA key recovery cli kra-key-retrieve generates an invalid p12 file
+- Bug 1897120 - pki-server cert-fix command failing
+- Bug 1694664 - ipa: ERROR: Certificate operation cannot be completed: Unable to communicate with CMS (503)
* Tue Nov 17 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.10.1-1
- Rebase to PKI 10.10.1
-- Bug #1843416 - kra-audit-mod fail with Invalid event configuration
-- Bug #1889691 - ACME failed when run with more than 1 thread/connection
-- Bug #1891577 - Sub-ordinate installation is failing with NullPointerException
+- Bug 1843416 - kra-audit-mod fail with Invalid event configuration
+- Bug 1889691 - ACME failed when run with more than 1 thread/connection
+- Bug 1891577 - Sub-ordinate installation is failing with NullPointerException
* Wed Oct 28 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.10.0-1
- Rebase to PKI 10.10.0
- Add workaround for missing capture_output in Python 3.6
- Fix JSS initialization in pki-server <subsystem>-user-cert-add
- Fix NPE in UGSubsystem.findUsersByKeyword()
-- Bug #1787115 - Need Method to copy SKI from CSR to Certificate signed
-- Bug #1875563 - Add KRA Transport and Storage Certificates profiles, audit for IPA
-- Bug #1883996 - Inconsistent folders in pki-tools
+- Bug 1787115 - Need Method to copy SKI from CSR to Certificate signed
+- Bug 1875563 - Add KRA Transport and Storage Certificates profiles, audit for IPA
+- Bug 1883996 - Inconsistent folders in pki-tools
* Tue Oct 20 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.10.0-0.2.beta1
- Rebase to PKI 10.10.0-beta1
-- Bug #1868233 - Disabling AIA and cert policy extensions in ACME examples
+- Bug 1868233 - Disabling AIA and cert policy extensions in ACME examples
* Fri Sep 11 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.9.4-1
- Rebase to PKI 10.9.4
-- Red Hat Bugzilla #1873235 - Fix SSL_ERROR_INAPPROPRIATE_FALLBACK_ALERT in pki ca-user-cert-add
+- Bug 1873235 - Fix SSL_ERROR_INAPPROPRIATE_FALLBACK_ALERT in pki ca-user-cert-add
* Thu Sep 03 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.9.3-1
- Rebase to PKI 10.9.3
-- Bug #1869893 - Common certificates are missing in CS.cfg on shared PKI instance
+- Bug 1869893 - Common certificates are missing in CS.cfg on shared PKI instance
* Tue Aug 18 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.9.2-2
-- Bug #1871064 - Replica install failing during pki-ca component configuration
+- Bug 1871064 - Replica install failing during pki-ca component configuration
* Tue Aug 18 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.9.2-1
- Rebase to PKI 10.9.2
* Wed Aug 12 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.9.1-2
-- Bug #1857933 - CA Installation is failing with ncipher v12.30 HSM
-- Bug #1868233 - Disabling AIA and cert policy extensions in ACME examples
+- Bug 1857933 - CA Installation is failing with ncipher v12.30 HSM
+- Bug 1868233 - Disabling AIA and cert policy extensions in ACME examples
* Thu Aug 06 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.9.1-1
- Rebase to PKI 10.9.1
-- Bug #1426572 - Fix Secure connection issue when server is down
+- Bug 1426572 - Fix Secure connection issue when server is down
* Fri Jul 31 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.9.0-1
- Rebase to PKI 10.9.0
-* Fri Jul 14 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.9.0-0.7
+* Tue Jul 14 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.9.0-0.7
- Fix pki kra-key-generate failure
- Fix error handling in PKIRealm
@@ -1468,16 +1475,16 @@ fi
* Tue Mar 03 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.8.3-1
- Rebase to PKI 10.8.3
-- Bug #1809210 - TPS installation failure on HSM machine
-- Bug #1807421 - Subordinate CA installation failed
-- Bug #1806840 - KRA cloning with HSM failed
+- Bug 1809210 - TPS installation failure on HSM machine
+- Bug 1807421 - Subordinate CA installation failed
+- Bug 1806840 - KRA cloning with HSM failed
* Wed Feb 19 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.8.2-2
-- Bug #1795215 - pkispawn interactive installation failed
+- Bug 1795215 - pkispawn interactive installation failed
* Mon Feb 17 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.8.2-1
- Rebase to PKI 10.8.2
-- Bug #1802006 - KRA installation failed to create ECC admin cert
+- Bug 1802006 - KRA installation failed to create ECC admin cert
* Mon Feb 10 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.8.1-1
- Rebase to PKI 10.8.1
@@ -1502,15 +1509,15 @@ fi
* Wed Aug 14 2019 Red Hat PKI Team <rhcs-maint@redhat.com> 10.7.3-1
- Rebase to PKI 10.7.3
-- Bug #1698084 - pkidestroy not working as expected
-- Bug #1468050 and Bug #1448235 - Support AES for LWCA key replication
+- Bug 1698084 - pkidestroy not working as expected
+- Bug 1468050 and Bug #1448235 - Support AES for LWCA key replication
* Tue Jul 23 2019 Red Hat PKI Team <rhcs-maint@redhat.com> 10.7.2-1
- Rebase to PKI 10.7.2
-- Bug #1721340 - TPS installation failure
-- Bug #1248216 - Incorrect pkidaemon status
-- Bug #1729215 - cert-fix: detect and prevent pkidbuser being used as --agent-uid
-- Bug #1698059 - pki-core implements crypto
+- Bug 1721340 - TPS installation failure
+- Bug 1248216 - Incorrect pkidaemon status
+- Bug 1729215 - cert-fix: detect and prevent pkidbuser being used as --agent-uid
+- Bug 1698059 - pki-core implements crypto
* Thu Jun 13 2019 Red Hat PKI Team <rhcs-maint@redhat.com> 10.7.1-2
- Fix cloning issue
@@ -1523,24 +1530,24 @@ fi
- Rebase to PKI 10.7.0
* Mon Jan 28 2019 Red Hat PKI Team <rhcs-maint@redhat.com> 10.6.9-2
-- Bug #1652269 - Replace Nuxwdog
+- Bug 1652269 - Replace Nuxwdog
* Mon Jan 14 2019 Red Hat PKI Team <rhcs-maint@redhat.com> 10.6.9-1
- Rebase to PKI 10.6.9
-- Bug #1629048 - X500Name.directoryStringEncodingOrder overridden by CSR encoding
-- Bug #1652269 - Replace Nuxwdog
-- Bug #1656856 - Need Method to Include SKI in CA Signing Certificate Request
+- Bug 1629048 - X500Name.directoryStringEncodingOrder overridden by CSR encoding
+- Bug 1652269 - Replace Nuxwdog
+- Bug 1656856 - Need Method to Include SKI in CA Signing Certificate Request
* Thu Nov 29 2018 Red Hat PKI Team <rhcs-maint@redhat.com> 10.6.8-1
- Rebase to PKI 10.6.8
-- Bug #1602659 - Fix issues found by covscan
-- Bug #1566360 - Fix missing serial number from pki-server subsystem-cert-find
+- Bug 1602659 - Fix issues found by covscan
+- Bug 1566360 - Fix missing serial number from pki-server subsystem-cert-find
* Fri Oct 26 2018 Red Hat PKI Team <rhcs-maint@redhat.com> 10.6.7-3
-- Bug #1643101 - Fix problems due to token normalization
+- Bug 1643101 - Fix problems due to token normalization
* Tue Oct 23 2018 Red Hat PKI Team <rhcs-maint@redhat.com> 10.6.7-2
-- Bug #1623444 - Fix Python KeyClient KeyRequestResponse parsing
+- Bug 1623444 - Fix Python KeyClient KeyRequestResponse parsing
* Fri Oct 05 2018 Red Hat PKI Team <rhcs-maint@redhat.com> 10.6.7-1
- Rebase to PKI 10.6.7
@@ -1550,7 +1557,7 @@ fi
* Wed Aug 22 2018 Alexander Bokovoy <abokovoy@redhat.com> 10.6.6-2
- Use platform-python interpreter
-- Bug #1620066 - pkispawn crashes as /usr/bin/python3 does not exist
+- Bug 1620066 - pkispawn crashes as /usr/bin/python3 does not exist
* Mon Aug 13 2018 Red Hat PKI Team <rhcs-maint@redhat.com> 10.6.6-1
- Rebase to PKI 10.6.6
@@ -1559,7 +1566,7 @@ fi
- Rebase to PKI 10.6.5
* Tue Aug 07 2018 Red Hat PKI Team <rhcs-maint@redhat.com> 10.6.4-4
-- Bug #1612063 - Do not override system crypto policy (support TLS 1.3)
+- Bug 1612063 - Do not override system crypto policy (support TLS 1.3)
* Wed Aug 01 2018 Red Hat PKI Team <rhcs-maint@redhat.com> 10.6.4-3
- Patch PKI to use Jackson 2 and avoid Jackson 1 dependency.
@@ -1579,8 +1586,8 @@ fi
* Thu Jun 28 2018 Red Hat PKI Team <rhcs-maint@redhat.com> 10.6.2-3
- Fix macro expressions
-- Bug #1566606 - pki-core: Switch to Python 3
-- Bug #1590467 - pki-core: Drop pylint dependency from RHEL 8
+- Bug 1566606 - pki-core: Switch to Python 3
+- Bug 1590467 - pki-core: Drop pylint dependency from RHEL 8
* Tue Jun 19 2018 Miro Hrončok <mhroncok@redhat.com> 10.6.2-2
- Rebuild for Python 3.7
@@ -1594,13 +1601,13 @@ fi
- Fix rpmlint warnings
* Fri May 04 2018 Red Hat PKI Team <rhcs-maint@redhat.com> 10.6.1-2
-- Bug #1574711 - pki-tools cannot be installed on current Rawhide
+- Bug 1574711 - pki-tools cannot be installed on current Rawhide
- Fix rpmlint warnings
* Thu May 03 2018 Red Hat PKI Team <rhcs-maint@redhat.com> 10.6.1-1
- Rebase to PKI 10.6.1
-- Bug #1559047 - pki-core misses a dependency to pki-symkey
-- Bug #1573094 - FreeIPA external CA installation fails
+- Bug 1559047 - pki-core misses a dependency to pki-symkey
+- Bug 1573094 - FreeIPA external CA installation fails
* Wed Apr 11 2018 Red Hat PKI Team <rhcs-maint@redhat.com> 10.6.0-1
- Update project URL and package descriptions