diff --git a/.ci/build_packages/tests.sh b/.ci/build_packages/tests.sh
index 01fdc07dc..b74d61ff2 100755
--- a/.ci/build_packages/tests.sh
+++ b/.ci/build_packages/tests.sh
@@ -89,11 +89,6 @@ emqx_test(){
             "rpm")
                 packagename=$(basename "${PACKAGE_PATH}/${EMQX_NAME}"-*.rpm)
 
-                if [[ "${ARCH}" == "amd64" && $(rpm -E '%{rhel}') == 7 ]] ; then
-                    # EMQX OTP requires openssl11 to have TLS1.3 support
-                    yum install -y openssl11
-                fi
-
                 rpm -ivh "${PACKAGE_PATH}/${packagename}"
                 if ! rpm -q emqx | grep -q emqx; then
                     echo "package install error"
diff --git a/CHANGES-4.3.md b/CHANGES-4.3.md
index a27122e59..d27c52ec3 100644
--- a/CHANGES-4.3.md
+++ b/CHANGES-4.3.md
@@ -27,6 +27,11 @@ File format:
 
 * For docker image, /opt/emqx/etc has been removed from the VOLUME list,
   this made it easier for the users to rebuild image on top with changed configs.
+* CentOS 7 Erlang runtime is rebuilt on OpenSSL-1.1.1n (previously on 1.0),
+  Prior to v4.3.13, EMQX pick certain cipher suites proposed by the clients,
+  but then fail to handshake resulting in a `malformed_handshake_data` exception.
+* CentOS 8 Erlang runtime is rebuilt on RockyLinux 8.
+  'centos8' will remain in the package name to keep it backward compatible.
 
 ### Enhancements
 
diff --git a/include/emqx_release.hrl b/include/emqx_release.hrl
index 682072ae9..60501474d 100644
--- a/include/emqx_release.hrl
+++ b/include/emqx_release.hrl
@@ -29,7 +29,7 @@
 
 -ifndef(EMQX_ENTERPRISE).
 
--define(EMQX_RELEASE, {opensource, "4.3.13-rc.2"}).
+-define(EMQX_RELEASE, {opensource, "4.3.13-rc.3"}).
 
 -else.
 
diff --git a/scripts/update-appup.sh b/scripts/update-appup.sh
index d5f3b5407..d62faee74 100755
--- a/scripts/update-appup.sh
+++ b/scripts/update-appup.sh
@@ -93,6 +93,7 @@ if [ "$NEW_COPY" = 'no' ]; then
     REMOTE="$(git remote -v | grep "${GIT_REPO}" | head -1 | awk '{print $1}')"
     git fetch "$REMOTE"
 fi
+git reset --hard
 git clean -fdx
 git checkout "${PREV_TAG}"
 make "$PROFILE"