diff -Nru ca-certificates-20050804/debian/changelog ca-certificates-20050804/debian/changelog
--- ca-certificates-20050804/debian/changelog	2008-04-02 18:36:45.000000000 +0100
+++ ca-certificates-20050804/debian/changelog	2008-04-08 11:51:16.000000000 +0100
@@ -1,3 +1,27 @@
+ca-certificates (20050804-0ubuntu0.6.10.1) hardy; urgency=low
+
+  * Fix up generation of the /etc/ssl/certs/ca-certificates.crt
+    file for those users who installed the package in a pt_BR
+    locale (LP: #153625). A mistake in the translation template
+    meant that the choices were not available in this locale,
+    and so the file was always empty.
+    - If you were affected and have not tried to reconfigure this
+      package, then the problem should be corrected for you
+      automatically.
+    - If you were affected and have tried to reconfigure the package
+      you may be shown a debconf question to allow you to select
+      the certificates that you want.
+    - The only users who were not affected by this bug but may
+      be affected by this fix are those who installed in a different
+      locale, and then reconfigured the package so that no
+      certificates are trusted, and who now run in a pt_BR locale.
+      They will have to deselect all of the certificates again.
+  * In addition to the previous version this version prevents the
+    question being asked multiple times for those who appear to
+    have been hit by this issue.
+
+ -- James Westby <james.westby@canonical.com>  Tue, 08 Apr 2008 11:50:48 +0100
+
 ca-certificates (20050804-0ubuntu0.6.10) edgy-proposed; urgency=low
 
   * Fix up generation of the /etc/ssl/certs/ca-certificates.crt
diff -Nru /tmp/vjn7Hqdcgc/ca-certificates-20050804/debian/config.in /tmp/5SovX6iFha/ca-certificates-20050804/debian/config.in
--- ca-certificates-20050804/debian/config.in	2008-04-02 18:25:33.000000000 +0100
+++ ca-certificates-20050804/debian/config.in	2008-04-08 11:50:41.000000000 +0100
@@ -179,31 +179,47 @@
 }
 
 PRIO=low
+set_values=true
 
 if dpkg --compare-versions "$cur_version" lt-nl "$pt_BR_fixed_version"; then
-  if [ -e "/etc/ssl/certs/ca-certificates.crt" ] && [ ! -s "/etc/ssl/certs/ca-certificates.crt" ]; then
-    pt_seen="false"
-    if db_fget ca-certificates/enable_crts seen; then
-      pt_seen="$RET"
-    fi
-    if [ "$pt_seen" = "false" ]; then
-      CERTS_ENABLED="$CERTS_AVAILABLE"
-    elif is_pt_BR; then
-      PRIO=critical
-      CERTS_ENABLED="$CERTS_AVAILABLE"
-      seen=false
-    else
-      seen=true
+  asked="false"
+  if db_fget ca-certificates/enable_crts asked_pt_br_question; then
+    asked="$RET"
+  fi
+  if [ "$asked" != "true" ]; then
+    if [ -e "/etc/ssl/certs/ca-certificates.crt" ] && [ ! -s "/etc/ssl/certs/ca-certificates.crt" ]; then
+      pt_seen="false"
+      if db_fget ca-certificates/enable_crts seen; then
+        pt_seen="$RET"
+      fi
+      if [ "$pt_seen" = "false" ]; then
+        CERTS_ENABLED="$CERTS_AVAILABLE"
+      elif is_pt_BR; then
+        PRIO=critical
+        CERTS_ENABLED="$CERTS_AVAILABLE"
+        seen=false
+      else
+        seen=true
+      fi
     fi
+  else
+    set_values=false
   fi
 fi
 
-db_set ca-certificates/enable_crts "$CERTS_ENABLED"
-db_subst ca-certificates/enable_crts enable_crts "$CERTS_AVAILABLE"
-if test "$seen" != true; then
- db_fset ca-certificates/enable_crts seen false
+if [ "$set_values" = "true" ]; then
+  db_set ca-certificates/enable_crts "$CERTS_ENABLED"
+  db_subst ca-certificates/enable_crts enable_crts "$CERTS_AVAILABLE"
+  if test "$seen" != true; then
+   db_fset ca-certificates/enable_crts seen false
+  fi
+  db_title "ca-certificates configuration"
+  db_input $PRIO ca-certificates/enable_crts || true
+  db_go
+
+  if [ "$PRIO" = "critical" ]; then
+    db_fset ca-certificates/enable_crts asked_pt_br_question true
+  fi
 fi
-db_title "ca-certificates configuration"
-db_input $PRIO ca-certificates/enable_crts || true
-db_go
+
 exit 0
diff -Nru /tmp/vjn7Hqdcgc/ca-certificates-20050804/debian/postinst /tmp/5SovX6iFha/ca-certificates-20050804/debian/postinst
--- ca-certificates-20050804/debian/postinst	2004-08-08 11:14:52.000000000 +0100
+++ ca-certificates-20050804/debian/postinst	2008-04-08 12:55:50.000000000 +0100
@@ -51,6 +51,7 @@
 	CERTS_ENABLED="$RET"
 	# XXX unmark seen for next configuration
 	db_fset ca-certificates/new_crts seen false
+	db_fset ca-certificates/enable_crts asked_pt_br_question false
 	db_stop || true
 	if test -f /etc/ca-certificates.conf; then
 	  # XXX: while in subshell?