I have a nix expression that builds a virtualbox vm. As part of that process, I install a self-signed ssl certificate via

certfile = builtins.readFile ./certificate.crt
security.pki.certificates = [ certfile ];

That works fine. The problem is if I want to run a nixos-rebuild to reconfigure the vm. Since I no longer have access to the original certfile from the vm build process (because I'm running in the vm, not on the machine where I built the vm), I can't just include the file again through the same mechanism.

I've come up with three ideas on how to do this:

  1. During the vm build process, place an extra copy of the cert under /root in the vm. Then I can just use this in my configuration.nix to pull in the certificate again:

    security.pki.certificates = [ /root/cert ];
  2. Since the certificate is always available for http download from an internal server, I could somehow use fetchUrl in the configuration.nix to download it every time I do a nixos-rebuild. I suppose the only downside to this would be introducing an external dependency.

  3. Since the certificate is in /etc/ssl/ca-certificates.crt, I could somehow extract it from that file as part ofthe rebuild process and then feed it to security.pki.certificates again.


2 Answers 2


You didn't specify what certfile looks like in the first line. If it's a variable thats populated with a builtins.readFile, you can skip that step and just populate the variable yourself.

$> nixos-option security.pki.certificates
... edited for brevity .... " ]

[ ]



A list of trusted root certificates in PEM format.

Declared by:

Defined by:

So, setting security.pki.certificates [ "insert certificate here" ]; would eliminate the file dependency and then the configuration is self contained.

Otherwise, if you wanted to keep the content out of the configuration, you'd need to create packaging/a derivation for it and add it to the store.

  • Sorry about that. You are right, certfile is a variable that is populated with builtins.readFile. Sep 2, 2015 at 20:12

i'm assuming you're deploying with nixops, but even if you don't you can create arguments for any nix script.

i did something similar in my server config here and then you use arguments as described here

  • Links broken, sadly
    – sean
    Jun 17, 2022 at 16:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .