diff -Nru ca-certificates-20170717~16.04.1/debian/ca-certificates-udeb.links ca-certificates-20170717~16.04.2/debian/ca-certificates-udeb.links
--- ca-certificates-20170717~16.04.1/debian/ca-certificates-udeb.links	1969-12-31 21:00:00.000000000 -0300
+++ ca-certificates-20170717~16.04.2/debian/ca-certificates-udeb.links	2018-12-06 16:19:45.000000000 -0200
@@ -0,0 +1 @@
+etc/ssl/certs usr/lib/ssl/certs
diff -Nru ca-certificates-20170717~16.04.1/debian/changelog ca-certificates-20170717~16.04.2/debian/changelog
--- ca-certificates-20170717~16.04.1/debian/changelog	2017-09-27 12:10:02.000000000 -0300
+++ ca-certificates-20170717~16.04.2/debian/changelog	2018-12-06 16:21:19.000000000 -0200
@@ -1,3 +1,9 @@
+ca-certificates (20170717~16.04.2) xenial; urgency=medium
+
+  * Add ca-certificates udeb package (LP: #1807023)
+
+ -- Mauricio Faria de Oliveira <mfo@canonical.com>  Thu, 06 Dec 2018 16:20:55 -0200
+
 ca-certificates (20170717~16.04.1) xenial-security; urgency=medium
 
   * Update ca-certificates database to 20170717:
diff -Nru ca-certificates-20170717~16.04.1/debian/control ca-certificates-20170717~16.04.2/debian/control
--- ca-certificates-20170717~16.04.1/debian/control	2016-02-08 10:39:47.000000000 -0200
+++ ca-certificates-20170717~16.04.2/debian/control	2018-12-06 16:19:45.000000000 -0200
@@ -7,7 +7,7 @@
            Thijs Kinkhorst <thijs@debian.org>,
            Christian Perrier <bubulle@debian.org>
 Build-Depends: debhelper (>= 9), po-debconf
-Build-Depends-Indep: python
+Build-Depends-Indep: python, openssl
 Standards-Version: 3.9.6
 Vcs-Git: git://anonscm.debian.org/collab-maint/ca-certificates.git
 Vcs-Browser: http://anonscm.debian.org/cgit/collab-maint/ca-certificates.git
@@ -30,3 +30,15 @@
  have in any way been audited for trustworthiness or RFC 3647 compliance.
  Full responsibility to assess them belongs to the local system
  administrator.
+
+Package: ca-certificates-udeb
+Package-Type: udeb
+Section: debian-installer
+Architecture: all
+Depends: ${misc:Depends}
+Description: Common CA certificates - udeb
+ Contains the certificate authorities shipped with Mozilla's browser,
+ all enabled by default.
+ .
+ This package is for use in the installer environment only.
+ Do not install on a normal system.
diff -Nru ca-certificates-20170717~16.04.1/debian/rules ca-certificates-20170717~16.04.2/debian/rules
--- ca-certificates-20170717~16.04.1/debian/rules	2017-09-27 12:13:58.000000000 -0300
+++ ca-certificates-20170717~16.04.2/debian/rules	2018-12-06 16:19:45.000000000 -0200
@@ -56,11 +56,17 @@
 	 cd $(CURDIR)/debian; \
 	 sed -e "s|#INITIAL_CERTS#|$$crts|" \
 		config.in > config)
+	# udeb handling
+	install -d -m 0755 "$(CURDIR)/debian/ca-certificates-udeb/etc/ssl/certs"
+	(cd mozilla; \
+	 $(MAKE) install CERTSDIR="$(CURDIR)/debian/ca-certificates-udeb/etc/ssl/certs")
+	c_rehash -v "$(CURDIR)/debian/ca-certificates-udeb/etc/ssl/certs"
 
 # Build architecture-independent files here.
 binary-indep: build install
 	dh_testdir
 	dh_testroot
+	dh_link
 	dh_installdebconf -n
 	dh_installdocs
 	dh_installexamples