Firefox on NixOS 23.05 Won't Connect to LAN-Based Server via HTTPS

Help
1

I’ve a laptop running NixOS 23.05 with both Firefox and Brave browsers that can both access WAN/Internet-based HTTPS servers but neither can access a local server on my LAN via HTTPS for which I have a cert.

I’ve unsuccessfully tried a number of things including the following lines in my configuration.nix

security.pki.certificateFiles = [ “/path/to/my-server.crt” ];

and

security.pki.certificates = [ ‘’ -----BEGIN CERTIFICATE----- …-----END CERTIFICATE-----" ];

I found what look like some clues at this link and here which seem to imply this issue has somehow been resolved.

This issue has been kicking my ass for the past three days, so any guidance, tips or links to solutions or tutorials greatly appreciated.

2

Quick question: is that my-server.crt a self-signed server certificate? Because that option is for installing CA certificates into the system trust store.

3

Here’s a test that includes how to generate the CA and server certificates and how to use them in NixOS. It will probably help.

4

The my-server.crt is generated by my LAN-based server acting presumably as a private, local CA.

5

I wouldn’t say: it’s much more common the other way around.

6

Thanks for the test script.

I already have the cert from my LAN-based server and don’t need to generate a new one. I’m trying to find how/where to import my local server’s cert into NixOS so NixOS-based browsers can access/use them.

However, I’m still very new to NixOS and especially the Nix language.

Am I to run this script unmodified to obtain test diagnostics? If so, do I use Nix or Nix-Env?

7

I already have the cert from my LAN-based server and don’t need to generate a new one. I’m trying to find how/where to import my local server’s cert into NixOS so NixOS-based browsers can access/use them.

The browsers validate the server by checking if the cert. has been signed by a CA in the system “trust store”, which is a list of root CA certs.
If the server cert. is self-signed (not signed by any other root or non-root CA) it won’t validate and you get an error.

In some browsers you may be able to add an exception by pinning the fingerprint of the server certificate, but this is something you have to do manually and not every browser allows.

What you should do instead is to generate a CA keypar, generate another keypar for the server and sign it using the CA. The you add the CA to the trust store and browsers will validate the server as usual.