diff --git a/debian/ca-certificates-udeb.links b/debian/ca-certificates-udeb.links
new file mode 100644
index 0000000..51bf8d3
--- /dev/null
+++ b/debian/ca-certificates-udeb.links
@@ -0,0 +1 @@
+etc/ssl/certs usr/lib/ssl/certs
diff --git a/debian/dirs b/debian/ca-certificates.dirs
similarity index 100%
rename from debian/dirs
rename to debian/ca-certificates.dirs
diff --git a/debian/postinst b/debian/ca-certificates.postinst
similarity index 100%
rename from debian/postinst
rename to debian/ca-certificates.postinst
diff --git a/debian/postrm b/debian/ca-certificates.postrm
similarity index 100%
rename from debian/postrm
rename to debian/ca-certificates.postrm
diff --git a/debian/changelog b/debian/changelog
index 3503b78..c77ea5c 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,17 @@
+ca-certificates (20161130) unstable; urgency=medium
+
+  [ Philipp Kern ]
+  * Add ca-certificates udeb package. Closes: #845456
+
+  [ Michael Shuler ]
+  * debian/{compat,control}:
+    Update to compat level 10 and debhelper (>= 10)
+    Shorten package description.
+  * debian/po/id.po
+    Update Indonesian debconf translation file for build time line reorder
+
+ -- Michael Shuler <michael@pbandjelly.org>  Wed, 30 Nov 2016 21:20:53 -0600
+
 ca-certificates (20161102) unstable; urgency=medium
 
   [ Michael Shuler ]
diff --git a/debian/compat b/debian/compat
index ec63514..f599e28 100644
--- a/debian/compat
+++ b/debian/compat
@@ -1 +1 @@
-9
+10
diff --git a/debian/control b/debian/control
index 86ad83c..d1218dc 100644
--- a/debian/control
+++ b/debian/control
@@ -5,8 +5,8 @@ Maintainer: Michael Shuler <michael@pbandjelly.org>
 Uploaders: Raphael Geissert <geissert@debian.org>,
            Thijs Kinkhorst <thijs@debian.org>,
            Christian Perrier <bubulle@debian.org>
-Build-Depends: debhelper (>= 9), po-debconf
-Build-Depends-Indep: python
+Build-Depends: debhelper (>= 10), po-debconf
+Build-Depends-Indep: python, openssl
 Standards-Version: 3.9.8
 Vcs-Git: https://anonscm.debian.org/git/collab-maint/ca-certificates.git
 Vcs-Browser: https://anonscm.debian.org/cgit/collab-maint/ca-certificates.git
@@ -18,14 +18,23 @@ Enhances: openssl
 Multi-Arch: foreign
 Breaks: ca-certificates-java (<<20121112+nmu1)
 Description: Common CA certificates
- This package includes PEM files of CA certificates to allow SSL-based
- applications to check for the authenticity of SSL connections.
- .
- It includes, among others, certificate authorities used by the Debian
- infrastructure and those shipped with Mozilla's browsers.
+ Contains the certificate authorities shipped with Mozilla's browser to allow
+ SSL-based applications to check for the authenticity of SSL connections.
  .
  Please note that Debian can neither confirm nor deny whether the
  certificate authorities whose certificates are included in this package
  have in any way been audited for trustworthiness or RFC 3647 compliance.
  Full responsibility to assess them belongs to the local system
  administrator.
+
+Package: ca-certificates-udeb
+Package-Type: udeb
+Section: debian-installer
+Architecture: all
+Depends: ${misc:Depends}
+Description: Common CA certificates - udeb
+ Contains the certificate authorities shipped with Mozilla's browser,
+ all enabled by default.
+ .
+ This package is for use in the installer environment only.
+ Do not install on a normal system.
diff --git a/debian/rules b/debian/rules
index fd4632b..a935300 100755
--- a/debian/rules
+++ b/debian/rules
@@ -17,7 +17,7 @@ build-arch: build-stamp
 
 build-indep: build-stamp
 
-build-stamp: configure-stamp 
+build-stamp: configure-stamp
 	dh_testdir
 
 	# Add here commands to compile the package.
@@ -56,16 +56,22 @@ install: build
 	 cd $(CURDIR)/debian; \
 	 sed -e "s|#INITIAL_CERTS#|$$crts|" \
 		config.in > config)
+	# udeb handling
+	install -d -m 0755 "$(CURDIR)/debian/ca-certificates-udeb/etc/ssl/certs"
+	(cd mozilla; \
+	 $(MAKE) install CERTSDIR="$(CURDIR)/debian/ca-certificates-udeb/etc/ssl/certs")
+	c_rehash -v "$(CURDIR)/debian/ca-certificates-udeb/etc/ssl/certs"
 
 # Build architecture-independent files here.
 binary-indep: build install
 	dh_testdir
 	dh_testroot
+	dh_link
 	dh_installdebconf -n
 	dh_installdocs
 	dh_installexamples
 	dh_installman sbin/update-ca-certificates.8
-	dh_installchangelogs 
+	dh_installchangelogs
 	dh_compress -X examples
 	dh_fixperms
 	dh_installdeb