diff -Nru ca-certificates-20141019+deb8u2/.gitignore ca-certificates-20141019+deb8u3/.gitignore
--- ca-certificates-20141019+deb8u2/.gitignore	1970-01-01 01:00:00.000000000 +0100
+++ ca-certificates-20141019+deb8u3/.gitignore	2017-04-28 00:44:48.000000000 +0200
@@ -0,0 +1,9 @@
+*.swp
+build-stamp
+configure-stamp
+debian/ca-certificates
+debian/ca-certificates.debhelper.log
+debian/ca-certificates.substvars
+debian/config
+debian/files
+mozilla/*.crt
diff -Nru ca-certificates-20141019+deb8u2/debian/changelog ca-certificates-20141019+deb8u3/debian/changelog
--- ca-certificates-20141019+deb8u2/debian/changelog	2016-11-30 14:23:24.000000000 +0100
+++ ca-certificates-20141019+deb8u3/debian/changelog	2017-04-28 00:44:48.000000000 +0200
@@ -1,3 +1,15 @@
+ca-certificates (20141019+deb8u3) jessie; urgency=medium
+
+  [ Michael Shuler ]
+  * sbin/update-ca-certificates:
+    Update local certificates directory when calling --fresh. Closes: #783615
+
+  [ Andreas Beckmann ]
+  * Backport another commit to make running update-certificates without hooks
+    actually work (instead of showing a usage message). Closes: #825730
+
+ -- Andreas Beckmann <anbe@debian.org>  Fri, 28 Apr 2017 00:44:48 +0200
+
 ca-certificates (20141019+deb8u2) stable; urgency=medium
 
   [ Michael Shuler ]
diff -Nru ca-certificates-20141019+deb8u2/sbin/update-ca-certificates ca-certificates-20141019+deb8u3/sbin/update-ca-certificates
--- ca-certificates-20141019+deb8u2/sbin/update-ca-certificates	2015-12-15 04:05:57.000000000 +0100
+++ ca-certificates-20141019+deb8u3/sbin/update-ca-certificates	2017-04-28 00:44:48.000000000 +0200
@@ -23,6 +23,13 @@
 
 verbose=0
 fresh=0
+CERTSCONF=/etc/ca-certificates.conf
+CERTSDIR=/usr/share/ca-certificates
+LOCALCERTSDIR=/usr/local/share/ca-certificates
+CERTBUNDLE=ca-certificates.crt
+ETCCERTSDIR=/etc/ssl/certs
+HOOKSDIR=/etc/ca-certificates/update.d
+
 while [ $# -gt 0 ];
 do
   case $1 in
@@ -30,6 +37,24 @@
       verbose=1;;
     --fresh|-f)
       fresh=1;;
+    --certsconf)
+      shift
+      CERTSCONF="$1";;
+    --certsdir)
+      shift
+      CERTSDIR="$1";;
+    --localcertsdir)
+      shift
+      LOCALCERTSDIR="$1";;
+    --certbundle)
+      shift
+      CERTBUNDLE="$1";;
+    --etccertsdir)
+      shift
+      ETCCERTSDIR="$1";;
+    --hooksdir)
+      shift
+      HOOKSDIR="$1";;
     --help|-h|*)
       echo "$0: [--verbose] [--fresh]"
       exit;;
@@ -37,11 +62,10 @@
   shift
 done
 
-CERTSCONF=/etc/ca-certificates.conf
-CERTSDIR=/usr/share/ca-certificates
-LOCALCERTSDIR=/usr/local/share/ca-certificates
-CERTBUNDLE=ca-certificates.crt
-ETCCERTSDIR=/etc/ssl/certs
+if [ ! -s "$CERTSCONF" ]
+then
+  fresh=1
+fi
 
 cleanup() {
   rm -f "$TEMPBUNDLE"
@@ -89,7 +113,7 @@
   find . -type l -print | while read symlink
   do
     case $(readlink $symlink) in
-      $CERTSDIR*) rm -f $symlink;;
+      $CERTSDIR*|$LOCALCERTSDIR*) rm -f $symlink;;
     esac
   done
   find . -type l -print | while read symlink
@@ -151,7 +175,9 @@
 
 echo "$ADDED_CNT added, $REMOVED_CNT removed; done."
 
-HOOKSDIR=/etc/ca-certificates/update.d
+if [ -d "$HOOKSDIR" ]
+then
+
 echo -n "Running hooks in $HOOKSDIR...."
 VERBOSE_ARG=
 [ "$verbose" = 0 ] || VERBOSE_ARG=--verbose
@@ -162,5 +188,7 @@
 done
 echo "done."
 
+fi
+
 # vim:set et sw=2: