diff -Nru ca-certificates-20070303/debian/changelog ca-certificates-20070303/debian/changelog
--- ca-certificates-20070303/debian/changelog	2008-03-29 05:59:06.000000000 +0000
+++ ca-certificates-20070303/debian/changelog	2008-04-02 11:30:28.000000000 +0100
@@ -1,3 +1,24 @@
+ca-certificates (20070303-0ubuntu2) hardy; urgency=low
+
+  * Improve on the last fix by trying to fix up the problem for
+    those that were affected. (LP: #153625)
+    - If upgrading from a broken version and the file is empty,
+      then
+      - if the question was never seen then act like a default
+        install
+      - if the question was seen and we are in pt_BR locale then
+        ask the question again defaulting to selected for all
+        certificates.
+      - else do nothing.
+    - This covers the common cases well, but may require people
+      who changed their locales to either answer a question they
+      already answered, or to run dpkg-reconfigure manually.
+    - All of this code should be dropped after hardy, as all upgrades
+      must go through hardy, and everyone will have a fixed version
+      then.
+
+ -- James Westby <james.westby@canonical.com>  Tue, 01 Apr 2008 14:58:12 +0100
+
 ca-certificates (20070303-0ubuntu1) hardy; urgency=low
 
   [ James Westby ]
diff -Nru /tmp/6JfztgmGSf/ca-certificates-20070303/debian/config.in /tmp/AwfxrBENIN/ca-certificates-20070303/debian/config.in
--- ca-certificates-20070303/debian/config.in	2007-02-02 06:23:19.000000000 +0000
+++ ca-certificates-20070303/debian/config.in	2008-04-02 12:43:22.000000000 +0100
@@ -6,6 +6,7 @@
 action="$1"
 cur_version="$2"
 this_version='#VERSION#'
+pt_BR_fixed_version="20070303-0ubuntu2"
 
 if test -f /etc/ca-certificates.conf; then
   CERTSCONF=/etc/ca-certificates.conf
@@ -158,12 +159,68 @@
 # mark seen true, so that dont ask again while postinst 
 db_fset ca-certificates/new_crts seen true
 
+# Ideally, we would be able to ask debconf for the language it's using, or
+# at least have a shell binding for setlocale(). Since we don't, we have to
+# do it all by hand.
+is_pt_BR () {
+  case $LANGUAGE in
+    pt_BR*)
+      return 0
+      ;;
+    *)
+      case $LC_ALL in
+    pt_BR*)
+      return 0
+      ;;
+    ?*)
+      return 1
+      ;;
+    *)
+      case $LC_MESSAGES in
+        pt_BR*)
+          return 0
+          ;;
+        ?*)
+          return 1
+          ;;
+        *)
+          case $LANG in
+        pt_BR*)
+          return 0
+          ;;
+          esac
+      esac
+      esac
+  esac
+  return 1
+}
+
+PRIO=low
+
+if dpkg --compare-versions "$cur_version" lt-nl "$pt_BR_fixed_version"; then
+  if [ -e "/etc/ssl/certs/ca-certificates.crt" ] && [ ! -s "/etc/ssl/certs/ca-certificates.crt" ]; then
+    pt_seen="false"
+    if db_fget ca-certificates/enable_crts seen; then
+      pt_seen="$RET"
+    fi
+    if [ "$pt_seen" = "false" ]; then
+      CERTS_ENABLED="$CERTS_AVAILABLE"
+    elif is_pt_BR; then
+      PRIO=critical
+      CERTS_ENABLED="$CERTS_AVAILABLE"
+      seen=false
+    else
+      seen=true
+    fi
+  fi
+fi
+
 db_set ca-certificates/enable_crts "$CERTS_ENABLED"
 db_subst ca-certificates/enable_crts enable_crts "$CERTS_AVAILABLE"
 if test "$seen" != true; then
  db_fset ca-certificates/enable_crts seen false
 fi
 db_title "ca-certificates configuration"
-db_input low ca-certificates/enable_crts || true
+db_input $PRIO ca-certificates/enable_crts || true
 db_go
 exit 0
Binary files /tmp/6JfztgmGSf/ca-certificates-20070303/.swp and /tmp/AwfxrBENIN/ca-certificates-20070303/.swp differ