diff --git a/bind-9.11-rh1500017.patch b/bind-9.11-rh1500017.patch
new file mode 100644
index 0000000..0605a75
--- /dev/null
+++ b/bind-9.11-rh1500017.patch
@@ -0,0 +1,75 @@
+From e3856204645c6547a7aae854e4f4138710864612 Mon Sep 17 00:00:00 2001
+From: Evan Hunt <each@isc.org>
+Date: Wed, 11 Oct 2017 08:51:03 -0700
+Subject: [PATCH] Move KRB5_CONFIG=/dev/null to conf.sh.* so the named run in
+ the tests gets the setting
+
+(cherry picked from commit 74f46c45b0868219512f52bb54d105ed65212f71)
+---
+ bin/tests/system/conf.sh.in       | 4 ++++
+ bin/tests/system/conf.sh.win32    | 4 ++++
+ bin/tests/system/tsiggss/tests.sh | 4 ----
+ 3 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
+index 8f73dbf..7b99e83 100644
+--- a/bin/tests/system/conf.sh.in
++++ b/bin/tests/system/conf.sh.in
+@@ -67,6 +67,9 @@ MAKEJOURNAL=$TOP/bin/tests/makejournal
+ PIPEQUERIES=$TOP/bin/tests/system/pipelined/pipequeries
+ SAMPLEUPDATE=$TOP/lib/samples/sample-update
+ 
++# we don't want a KRB5_CONFIG setting breaking the tests
++KRB5_CONFIG=/dev/null
++
+ # The "stress" test is not run by default since it creates enough
+ # load on the machine to make it unusable to other users.
+ # v6synth
+@@ -150,6 +153,7 @@ export KEYFRLAB
+ export KEYGEN
+ export KEYSETTOOL
+ export KEYSIGNER
++export KRB5_CONFIG
+ export LWRESD
+ export LWTEST
+ export MAKEJOURNAL
+diff --git a/bin/tests/system/conf.sh.win32 b/bin/tests/system/conf.sh.win32
+index e2d7855..55175b4 100644
+--- a/bin/tests/system/conf.sh.win32
++++ b/bin/tests/system/conf.sh.win32
+@@ -73,6 +73,9 @@ LWTEST=$TOP/Build/$VSCONF/lwtest@EXEEXT@
+ MAKEJOURNAL=$TOP/Build/$VSCONF/makejournal@EXEEXT@
+ PIPEQUERIES=$TOP/Build/$VSCONF/pipequeries@EXEEXT@
+ 
++# we don't want a KRB5_CONFIG setting breaking the tests
++KRB5_CONFIG=/dev/null
++
+ # The "stress" test is not run by default since it creates enough
+ # load on the machine to make it unusable to other users.
+ # v6synth
+@@ -150,6 +153,7 @@ export KEYFRLAB
+ export KEYGEN
+ export KEYSETTOOL
+ export KEYSIGNER
++export KRB5_CONFIG
+ export LWRESD
+ export LWTEST
+ export MAKEJOURNAL
+diff --git a/bin/tests/system/tsiggss/tests.sh b/bin/tests/system/tsiggss/tests.sh
+index 7576a93..2198cf1 100644
+--- a/bin/tests/system/tsiggss/tests.sh
++++ b/bin/tests/system/tsiggss/tests.sh
+@@ -15,10 +15,6 @@ status=0
+ 
+ DIGOPTS="@10.53.0.1 -p 5300"
+ 
+-# we don't want a KRB5_CONFIG setting breaking the tests
+-KRB5_CONFIG=/dev/null
+-export KRB5_CONFIG
+-
+ test_update() {
+     host="$1"
+     type="$2"
+-- 
+2.9.5
+
diff --git a/bind.spec b/bind.spec
index 16c6226..55941e6 100644
--- a/bind.spec
+++ b/bind.spec
@@ -83,6 +83,7 @@ Patch140:bind-9.11-rh1410433.patch
 Patch141:bind-9.11-rh1236087.patch
 Patch142:bind-9.11-rh1484451.patch
 Patch145:bind-9.11-rh1205168.patch
+Patch146:bind-9.11-rh1500017.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -326,6 +327,7 @@ This package provides a module which allows commands to be sent to rndc directly
 %patch141 -p1 -b .rh1236087
 %patch142 -p1 -b .rh1484451
 %patch145 -p1 -b .rh1205168
+%patch146 -p1 -b .rh1500017
 
 %if %{PKCS11}
 cp -r bin/named{,-pkcs11}
@@ -1031,6 +1033,7 @@ rm -rf ${RPM_BUILD_ROOT}
 %changelog
 * Fri Dec 15 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.1-4.P3
 - Own python3-bind isc directory (#1522944)
+- Make tsstsig system test pass again (#1500017)
 
 * Mon Oct 23 2017 Petr Menšík <pemensik@redhat.com> - 32:9.11.1-3.P3
 - Include DNSKEY 20326 also in trusted-key.key (#1505476)