diff --git a/debian/patches/17_check_smtp_forcetls_on_cert b/debian/patches/17_check_smtp_forcetls_on_cert
new file mode 100644
index 0000000..0e92a1e
--- /dev/null
+++ b/debian/patches/17_check_smtp_forcetls_on_cert
@@ -0,0 +1,36 @@
+From dfe66c01c0b556dfbac9c1d901d3ba9ed6a1deac Mon Sep 17 00:00:00 2001
+From: Holger Weiss <holger@zedat.fu-berlin.de>
+Date: Tue, 6 Oct 2015 23:28:24 +0200
+Subject: [PATCH] check_smtp: Let "-D" option imply "-S"
+
+---
+ plugins/check_smtp.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/plugins/check_smtp.c b/plugins/check_smtp.c
+index 753ea3e..2e9b68b 100644
+--- a/plugins/check_smtp.c
++++ b/plugins/check_smtp.c
+@@ -582,11 +582,6 @@ process_arguments (int argc, char **argv)
+ 				usage4 (_("Timeout interval must be a positive integer"));
+ 			}
+ 			break;
+-		case 'S':
+-		/* starttls */
+-			use_ssl = TRUE;
+-			use_ehlo = TRUE;
+-			break;
+ 		case 'D':
+ 		/* Check SSL cert validity */
+ #ifdef USE_OPENSSL
+@@ -612,6 +607,10 @@ process_arguments (int argc, char **argv)
+ #else
+ 			usage (_("SSL support not available - install OpenSSL and recompile"));
+ #endif
++		case 'S':
++		/* starttls */
++			use_ssl = TRUE;
++			use_ehlo = TRUE;
+ 			break;
+ 		case '4':
+ 			address_family = AF_INET;
diff --git a/debian/patches/series b/debian/patches/series
index 6a102d5..24fec58 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -7,3 +7,4 @@
 14_sslutils_superfluous_parenthesis
 15_check_smtp_expect
 16_check_smtp_quit
+17_check_smtp_forcetls_on_cert