diff --git a/upgrade.py b/upgrade.py
index 721aea23..1e788fac 100644
--- a/upgrade.py
+++ b/upgrade.py
@@ -173,13 +173,17 @@ def restore_file(src_base, f, d=None):
                         assert 'dst' in f
                         restore_file(tds.mount_point, f['src'], f['dst'])
                     elif 'dir' in f:
-                        pat = 're' in f and f['re'] or None
+                        pat = f.get('re', None)
                         src_dir = os.path.join(tds.mount_point, f['dir'])
                         if os.path.exists(src_dir):
-                            for ff in os.listdir(src_dir):
-                                fn = os.path.join(f['dir'], ff)
-                                if not pat or pat.match(fn):
-                                    restore_file(tds.mount_point, fn)
+                            if pat is not None:
+                                # filter here (though should ideally let restore_file do it)
+                                for ff in os.listdir(src_dir):
+                                    fn = os.path.join(f['dir'], ff)
+                                    if pat.match(fn):
+                                        restore_file(tds.mount_point, fn)
+                            else:
+                                restore_file(tds.mount_point, f['dir'])
         finally:
             tds.unmount()
 
@@ -462,7 +466,7 @@ def buildRestoreList(self, src_base):
 
         # Preserve pool certificates across upgrades
         self.restore_list += ['etc/stunnel/xapi-pool-ca-bundle.pem', {'dir': 'etc/stunnel/certs-pool'}]
-        self.restore_list += [{'dir': 'etc/stunnel/certs'}]
+        self.restore_list += ['etc/stunnel/xapi-stunnel-ca-bundle.pem', {'dir': 'etc/stunnel/certs'}]
 
     completeUpgradeArgs = ['mounts', 'installation-to-overwrite', 'primary-disk', 'backup-partnum', 'logs-partnum', 'net-admin-interface', 'net-admin-bridge', 'net-admin-configuration']
     def completeUpgrade(self, mounts, prev_install, target_disk, backup_partnum, logs_partnum, admin_iface, admin_bridge, admin_config):