SSL certificate verification failed despite adding files to ca-certificatesFiles
0 reputation · 19 Nov 2024, 01:04 UTC
In NixOS, the system-wide trust store is managed via the ca-certificates package and the security.ca-certificatesFiles option. While adding custom CA bundles to this configuration successfully updates the global store during a rebuild, certain runtimes and environments still fail to recognize these certificates during TLS handshakes.
The issue persists when language-specific environments, such as Java (JVM) or Python, look for hardcoded paths or standard locations like /etc/ssl/certs instead of the Nix store-managed paths generated by the system. Even when openssl s_client validates the chain using the system-wide store, these applications report 'certificate verify failed' errors.
How can one ensure that non-native runtimes consistently consume the Nix-managed CA store without manual environment variable overrides? Is there a native NixOS mechanism to point these environments to the certificates defined in security.ca-certificatesFiles?
nixos