diff --git a/src/main/java/ch/eitchnet/privilege/handler/DefaultPrivilegeHandler.java b/src/main/java/ch/eitchnet/privilege/handler/DefaultPrivilegeHandler.java
index 0d2e284b8..fe9f2a175 100644
--- a/src/main/java/ch/eitchnet/privilege/handler/DefaultPrivilegeHandler.java
+++ b/src/main/java/ch/eitchnet/privilege/handler/DefaultPrivilegeHandler.java
@@ -639,7 +639,7 @@ public class DefaultPrivilegeHandler implements PrivilegeHandler {
 
 			// make sure not a system user - they may not login in
 			if (user.getUserState() == UserState.SYSTEM) {
-				String msg = "User {0} is a system user and may no login!"; //$NON-NLS-1$
+				String msg = "User {0} is a system user and may not login!"; //$NON-NLS-1$
 				msg = MessageFormat.format(msg, username);
 				throw new AccessDeniedException(msg);
 			}
diff --git a/src/main/java/ch/eitchnet/privilege/model/Certificate.java b/src/main/java/ch/eitchnet/privilege/model/Certificate.java
index 2d417f86c..1bac8c70e 100644
--- a/src/main/java/ch/eitchnet/privilege/model/Certificate.java
+++ b/src/main/java/ch/eitchnet/privilege/model/Certificate.java
@@ -16,6 +16,7 @@
 package ch.eitchnet.privilege.model;
 
 import java.io.Serializable;
+import java.util.Collections;
 import java.util.Locale;
 import java.util.Map;
 
@@ -88,7 +89,7 @@ public final class Certificate implements Serializable {
 		else
 			this.locale = locale;
 
-		this.propertyMap = propertyMap;
+		this.propertyMap = Collections.unmodifiableMap(propertyMap);
 	}
 
 	/**