diff --git a/debian/changelog b/debian/changelog
index bf6455e..821a12a 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+ca-certificates (20081127) unstable; urgency=low
+
+  * Remove /etc/ssl{,/certs} in postrm to please piuparts.  (Closes:
+    #454334)
+
+ -- Philipp Kern <pkern@debian.org>  Thu, 27 Nov 2008 19:13:17 +0100
+
 ca-certificates (20080809) unstable; urgency=low
 
   * New cacert.org.pem joining both CACert Class 1 and Class 3 certificates.
diff --git a/debian/config b/debian/config
index c0e5c6e..159b012 100644
--- a/debian/config
+++ b/debian/config
@@ -5,7 +5,7 @@ set -e
 
 action="$1"
 cur_version="$2"
-this_version='20080809'
+this_version='20081127'
 pt_BR_fixed_version="20080616"
 
 if test -f /etc/ca-certificates.conf; then
diff --git a/debian/postrm b/debian/postrm
index 260a1c4..e4feb3e 100644
--- a/debian/postrm
+++ b/debian/postrm
@@ -28,8 +28,12 @@ case "$1" in
 
     purge)
        rm -f /etc/ssl/certs/ca-certificates.crt*
-       # Fix for #454334
-       rmdir  --ignore-fail-on-non-empty /etc/ssl
+
+       # Clean up even if openssl is removed before ca-certificates.
+       # (Which is what piuparts does.)
+       [ -d /etc/ssl/certs ] && rmdir --ignore-fail-on-non-empty /etc/ssl/certs
+       [ -d /etc/ssl ] && rmdir --ignore-fail-on-non-empty /etc/ssl
+
        rm -f /etc/ca-certificates.conf*
        if test -e /usr/share/debconf/confmodule; then
          . /usr/share/debconf/confmodule