diff --git a/debian/ca-certificates-mono.install b/debian/ca-certificates-mono.install
new file mode 100644
index 0000000000..6809b00246
--- /dev/null
+++ b/debian/ca-certificates-mono.install
@@ -0,0 +1,3 @@
+/usr/bin/cert-sync
+/usr/lib/mono/4.5/cert-sync.exe*
+debian/mono-keystore			/etc/ca-certificates/update.d/
diff --git a/debian/ca-certificates-mono.triggers b/debian/ca-certificates-mono.triggers
new file mode 100644
index 0000000000..7b153d9875
--- /dev/null
+++ b/debian/ca-certificates-mono.triggers
@@ -0,0 +1,2 @@
+activate update-ca-certificates
+
diff --git a/debian/control.REMOVED.git-id b/debian/control.REMOVED.git-id
index dcf601ea5c..9302096bfc 100644
--- a/debian/control.REMOVED.git-id
+++ b/debian/control.REMOVED.git-id
@@ -1 +1 @@
-c2bb54cc89a990c47859f27a34260417b4e95982
\ No newline at end of file
+82202a3c693b4ed172f5f25ba040c109519b7c7f
\ No newline at end of file
diff --git a/debian/mono-keystore b/debian/mono-keystore
new file mode 100755
index 0000000000..684e8657fd
--- /dev/null
+++ b/debian/mono-keystore
@@ -0,0 +1,12 @@
+#!/bin/sh
+
+set -e
+
+echo "Updating Mono key store"
+
+# always return true, even if the tool blows up for some reason.
+# we don't want to mess with users at install-time. failure here
+# isn't really fatal anyway, just inconvenient
+/usr/bin/cert-sync /etc/ssl/certs/ca-certificates.crt || true
+
+echo "Done"