diff --git a/debian/changelog b/debian/changelog
index 943c249e..902840ec 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -6,6 +6,7 @@ debian-cd (3.1.21) UNRELEASED; urgency=medium
     network-manager-gnome, synaptic)
   * Start buster, simply copying stretch for now
   * Add SHA256 checksums to Packages files for update images
+  * Make update_popcon deal with https on popcon.d.o
 
   [ JH Chatenet ]
   * Include debian-ports-archive-keyring on non released architectures
diff --git a/tools/update_popcon b/tools/update_popcon
index 988c92c0..19af2486 100755
--- a/tools/update_popcon
+++ b/tools/update_popcon
@@ -7,6 +7,11 @@
 
 DATE=`date`
 
+dir=/etc/ssl/ca-debian
+if [ -d $dir ]; then
+    capath="--capath $dir"
+fi
+
 # Determine temp dir to use
 if [ "$BDIR"x = ""x ] ; then
     if [ "$TMPDIR"x != ""x ] ; then
@@ -33,7 +38,7 @@ dl_file () {
     DIST=$1
     SITE="http://popcon.debian.org/"
 
-    curl -s --head $SITE/$DIST/by_inst > $TDIR/$DIST.head
+    curl -L $capath -s --head $SITE/$DIST/by_inst > $TDIR/$DIST.head
     error=$?
     if [ $error -ne 0 ] ; then
         echo "Failed to download correctly: curl error $error on HEAD" >&2
@@ -42,7 +47,7 @@ dl_file () {
     HEAD_SIZE=`cat $TDIR/$DIST.head | \
                awk '/^Content-Length/ {gsub("\r","");print $2}'`
 
-    curl -s $SITE/$DIST/by_inst > $TDIR/$DIST
+    curl -L $capath -s $SITE/$DIST/by_inst > $TDIR/$DIST
     error=$?
     DL_SIZE=`stat -c %s $TDIR/$DIST`
     if [ $error -ne 0 ] ; then