I've managed to install citrix receiver and configure it manually with the certs I need to log into my work computers, but I want to have this be part of my automatic provisioning that happens with nixos-rebuild

The steps to install and configure were as such:

  • Install Citrix Receiver

$ nix-env -i --arg config '{ allowUnfree = true;}' citrix-receiver

  • as root remount /nix/store in rw

# mount -o remount,rw /nix/store

  • Go to the location of the icaclient keystore

# cd home/dw/.nix-profile/opt/citrix-icaclient/keystore

  • Remove the cacerts directory that it defaults to and recreate cacerts as a symlink to /etc/ssl/certs

# rm -rf cacerts && ln -s /etc/ssl/certs cacerts

  • Go to cacerts and get Symantec certificates and unzip

# cd cacerts && wget http://www.symantec.com/content/en/us/enterprise/verisign/roots/roots.zip && unzip roots.zip

  • Look recursively for pem files after unzip and copy them into current directory

find . -name "*.pem" -type f -exec cp {} . \;

This all worked, but I have yet to find a good way to do this as part of regular provisioning.

Any nixos people that know the best way to do this?

  • 1
    Ideally what you'd do is override the citrix-receiver package so that it uses a custom cacert package containing your certificates. The citrix-receiver package takes cacert as a parameter. But first you'd have to produce a cacert deviration which matches what citrix-receiver expects; Which is a derivation which produces /nix/store/abc123-symantec-cacert/etc/ssl/certs/ca-bundle.crt. citrix-receiver reads that bundle and produces the PEM files. Take a look at /etc/static/ssl/certs/ca-bundle.crt to get a sense of how to produce the bundle. Commented Mar 26, 2018 at 19:02

1 Answer 1


You could rebuild the citrix-receiver package with your own bundle:

The following code is untested. It could be put into environment.systemPackages in configuration.nix.

(citrix-reveiver.override {
  cacert = stdenv.mkDerivation {
    name = "symantic-cacerts";
    src = null;
    unpackPhase = ":";
    installPhase = ''
      ${pkgs.unzip}/bin/unzip ${./roots.zip}
      mkdir $out/etc/ssl/certs/
      find . -name "*.pem" -type f | xargs cat > $out/etc/ssl/certs/ca-bundle.crt

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .