This desktop computer is on a monitored network that needs a ca.crt root certificate to be installed in order to access internet. Yes, this is indeed a man-in-the-middle setup.

It creates a catch-22 situation in regards to installing NixOS because it is an online installer. Even if I add the certificate's code to security.pki.certificates after booting the NixOS live installer, as explained here


it still won't work because internet is needed to commit the change.

So what's the solution? Can I remaster the NixOS ISO in some way to include the ca.crt?

And if so, the installed system will also need the ca.crt to be installed manually, for the same reason. If I access the NixOS file system, for instance from a live flash drive, can I manually insert this ca.crt somewhere? How and where? The end goal is for the installed NixOS system to have a recognized root certificate, so I can access internet and get on with things.

1 Answer 1


There is NIX_SSL_CERT_FILE as environment variable. It's respected by openssl and gnutls, so most programs get covered by that.

  • Is it editable, and where is the storage location?
    – shmu
    Apr 28, 2023 at 13:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .