diff -Nru barbican-2.0.0/debian/changelog barbican-2.0.0/debian/changelog
--- barbican-2.0.0/debian/changelog	2016-04-07 19:29:08.000000000 +0300
+++ barbican-2.0.0/debian/changelog	2017-01-09 13:57:16.000000000 +0300
@@ -1,3 +1,11 @@
+barbican (1:2.0.0-0ubuntu2) xenial; urgency=medium
+
+  [ Dmitrii Shcherbakov ]
+  * d/p/backport-4c6704eda7.patch: Fix circular dependency  of
+    certificate_manager module
+
+ -- Dmitrii Shcherbakov <dmitrii.shcherbakov@canonical.com>  Mon, 09 Jan 2017 13:40:45 +0300
+
 barbican (1:2.0.0-0ubuntu1) xenial; urgency=medium
 
   [ David Della Vecchia ]
diff -Nru barbican-2.0.0/debian/patches/backport-4c6704eda7.patch barbican-2.0.0/debian/patches/backport-4c6704eda7.patch
--- barbican-2.0.0/debian/patches/backport-4c6704eda7.patch	1970-01-01 03:00:00.000000000 +0300
+++ barbican-2.0.0/debian/patches/backport-4c6704eda7.patch	2017-01-09 13:31:11.000000000 +0300
@@ -0,0 +1,104 @@
+Description: Fix circular dependency of certificate_manager module
+  Backport an upstream patch.
+  Fix circular dependency of certificate_manager module
+  The certificate_manager module had a circular dependency that made it
+  problematic to use for certain versions of the python interpreter.
+  This was because we were initializing a singleton EVENT_PLUGIN_MANAGER
+  that in turn loaded the plugins; The problem was that the plugins
+  imported certificate_manger themselves and this caused the circular
+  dependency. So instead of creating that class in the module, I
+  created a function that should be called instead.
+Change-Id: I9cdb7c3ecc9c275ee561363f6ce13248259f88d0
+Author: Dmitrii Shcherbakov <dmitrii.shcherbakov@canonical.com>
+Origin: backport
+Bug: https://bugs.launchpad.net/ubuntu/+source/barbican/+bug/1570356
+Applied-Upstream: 4c6704eda78bcac87b9bd17e6bd0e2f2c25d1429
+Last-Update: 2017-01-09
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/barbican/plugin/interface/certificate_manager.py
++++ b/barbican/plugin/interface/certificate_manager.py
+@@ -105,6 +105,10 @@
+ INFO_EXPIRATION = "expiration"
+ 
+ 
++# Singleton to avoid loading the CertificateEventManager plugins more than once
++_EVENT_PLUGIN_MANAGER = None
++
++
+ class CertificateRequestType(object):
+     """Constants to define the certificate request type."""
+     CUSTOM_REQUEST = "custom"
+@@ -702,8 +706,8 @@
+ 
+     Each time this class is initialized it will load a new instance
+     of each enabled plugin. This is undesirable, so rather than initializing a
+-    new instance of this class use the EVENT_PLUGIN_MANAGER at the module
+-    level.
++    new instance of this class use the get_event_plugin_manager function
++    at the module level.
+     """
+     def __init__(self, conf=CONF, invoke_args=(), invoke_kwargs={}):
+         super(_CertificateEventPluginManager, self).__init__(
+@@ -750,4 +754,9 @@
+             getattr(plugin, method)(*args, **kwargs)
+ 
+ 
+-EVENT_PLUGIN_MANAGER = _CertificateEventPluginManager()
++def get_event_plugin_manager():
++    global _EVENT_PLUGIN_MANAGER
++    if _EVENT_PLUGIN_MANAGER:
++        return _EVENT_PLUGIN_MANAGER
++    _EVENT_PLUGIN_MANAGER = _CertificateEventPluginManager()
++    return _EVENT_PLUGIN_MANAGER
+--- a/barbican/tasks/certificate_resources.py
++++ b/barbican/tasks/certificate_resources.py
+@@ -516,7 +516,7 @@
+ 
+ def _notify_ca_unavailable(order_model, result):
+     """Notify observer(s) that the CA was unavailable at this time."""
+-    cert.EVENT_PLUGIN_MANAGER.notify_ca_is_unavailable(
++    cert.get_event_plugin_manager().notify_ca_is_unavailable(
+         order_model.project_id,
+         hrefs.convert_order_to_href(order_model.id),
+         result.status_message,
+--- a/barbican/tests/plugin/interface/test_certificate_manager.py
++++ b/barbican/tests/plugin/interface/test_certificate_manager.py
+@@ -38,7 +38,7 @@
+         self.plugin_name = common_utils.generate_fullname_for(
+             self.plugin_returned)
+         self.plugin_loaded = mock.MagicMock(obj=self.plugin_returned)
+-        self.manager = cm.EVENT_PLUGIN_MANAGER
++        self.manager = cm.get_event_plugin_manager()
+         self.manager.extensions = [self.plugin_loaded]
+ 
+     def test_get_plugin_by_name(self):
+--- a/barbican/tests/tasks/test_certificate_resources.py
++++ b/barbican/tests/tasks/test_certificate_resources.py
+@@ -395,7 +395,7 @@
+         """Mock the certificate event plugin manager."""
+         self.cert_event_plugin_patcher = mock.patch(
+             'barbican.plugin.interface.certificate_manager'
+-            '.EVENT_PLUGIN_MANAGER'
++            '._EVENT_PLUGIN_MANAGER'
+         )
+         self.cert_event_plugin_patcher.start()
+ 
+@@ -690,7 +690,7 @@
+ 
+         self._verify_issue_certificate_plugins_called()
+ 
+-        epm = self.cert_event_plugin_patcher.target.EVENT_PLUGIN_MANAGER
++        epm = self.cert_event_plugin_patcher.target._EVENT_PLUGIN_MANAGER
+         epm.notify_ca_is_unavailable.assert_called_once_with(
+             self.project.id,
+             order_ref,
+@@ -775,7 +775,7 @@
+ 
+         self._verify_check_certificate_plugins_called()
+ 
+-        epm = self.cert_event_plugin_patcher.target.EVENT_PLUGIN_MANAGER
++        epm = self.cert_event_plugin_patcher.target._EVENT_PLUGIN_MANAGER
+         epm.notify_ca_is_unavailable.assert_called_once_with(
+             self.project.id,
+             order_ref,
diff -Nru barbican-2.0.0/debian/patches/series barbican-2.0.0/debian/patches/series
--- barbican-2.0.0/debian/patches/series	2016-04-07 19:29:08.000000000 +0300
+++ barbican-2.0.0/debian/patches/series	2017-01-09 13:07:10.000000000 +0300
@@ -1 +1,2 @@
 ldap3-to-ldap.patch
+backport-4c6704eda7.patch