Cert issue with Zscaler

Help
1

Hello, I am trying to use Nix on my work computer. They have deployed Zscaler, which is injecting its own certs. I have tried setting NIX_SSL_CERT_FILE to the zscaler root cert but nix-shell is still throwing cert errors. How can I fix this?

$ nix-shell  -p bash
warning: error: unable to download 'https://cache.nixos.org/hmqbxa61rp45z3czgq3adm5fjd0qywh9.narinfo': SSL peer certificate or SSH remote key was not OK (60); retrying in 258 ms
warning: error: unable to download 'https://cache.nixos.org/32knm2y5g4x541xav6r6y7rhij8cg7lx.narinfo': SSL peer certificate or SSH remote key was not OK (60); retrying in 265 ms
warning: error: unable to download 'https://cache.nixos.org/17b5l9alb7qpsp8lmr5n6wxb28gym4jr.narinfo': SSL peer certificate or SSH remote key was not OK (60); retrying in 256 ms
warning: error: unable to download 'https://cache.nixos.org/69yz72wwqfz7wbx1k2pd1f29wqzh3irl.narinfo': SSL peer certificate or SSH remote key was not OK (60); retrying in 317 ms
warning: error: unable to download 'https://cache.nixos.org/skr40k4d29vyv4nqdmi7dnfw1bvjqx89.narinfo': SSL peer certificate or SSH remote key was not OK (60); retrying in 292 ms
warning: error: unable to download 'https://cache.nixos.org/hmqbxa61rp45z3czgq3adm5fjd0qywh9.narinfo': SSL peer certificate or SSH remote key was not OK (60); retrying in 555 ms
warning: error: unable to download 'https://cache.nixos.org/32knm2y5g4x541xav6r6y7rhij8cg7lx.narinfo': SSL peer certificate or SSH remote key was not OK (60); retrying in 643 ms

Does nix-shell not read the NIX_SSL_CERT_FILE environment variable?

1 Like
2

Is this a multi-user or single-user installation?

In a multi-user installation the demon needs to also be set up to see the environment variable.

3

It is multiuser, on MacOS. Any tips/references on how to how to configure the daemon to see the cert?

4

Perhaps check the manual?

https://nixos.org/manual/nix/stable/installation/env-variables.html?highlight=certi#nix_ssl_cert_file-with-macos-and-the-nix-daemon

Be aware that the section is rather short and might not be starting at the top after visiting the link.