# Install root certificate
**URL:** https://discourse.nixos.org/t/install-root-certificate/25726
**Category:** Help
**Created:** [February 23, 2023, 3:06pm UTC](https://discourse.nixos.org/t/install-root-certificate/25726 "2023-02-23T15:06:04Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@shmu26](https://discourse.nixos.org/u/shmu26)
#### Post date: [February 23, 2023, 3:06pm UTC](https://discourse.nixos.org/t/install-root-certificate/25726/1 "2023-02-23T15:06:04Z")
I want to install NixOS on a computer that accesses the internet through a proxy that needs a root certificate.
Below is the instructions how to acquire and install this certificate on other versions of Linux.
How can I do this on an out-of-the-box installation of NixOS?
The catch is that the system will not be able to update or download packages until the certificate is already installed. But I can install the certificate manually in Firefox, and download packages that way, if necessary.
[http://wiki.netfree.link/wiki/Installation\_of\_certificate\_in\_Linux\_operating\_system](http://wiki.netfree.link/wiki/Installation_of_certificate_in_Linux_operating_system)
This script is active in Linux distributions based on Debian, CentOS, Alpine and ArchLinux.
Open the command line,run the following command:
curl -sL [https://netfree.link/dl/unix-ca.sh](https://netfree.link/dl/unix-ca.sh) | sudo sh
Or
curl -sL [https://netfree.link/dl/unix-ca.sh](https://netfree.link/dl/unix-ca.sh) | sh
Sometimes the command will fail due to the fact that `curl` isn’t installed, and it will give a message: `Command 'curl' not found`
To fix this, enter the command:
sudo sh -c “(apt update && apt install -y curl) || yum install -y curl || apk add curl”
Then re-run the previous command.
It is recommended that you restart the computer after this.
⚠ In order to install the certificate you need root permission.
⚠To use Firefox you must install the [security certificate separately](http://wiki.netfree.link/wiki/Installation_of_certificate_in_Firefox_browser). You can also install a certificate for [Chrome](http://wiki.netfree.link/wiki/Installation_of_certificate_in_Chrome_browser_in_Linux) individually.
---
### Author:  [@NobbZ](https://discourse.nixos.org/u/NobbZ)
#### Post date: [February 23, 2023, 3:50pm UTC](https://discourse.nixos.org/t/install-root-certificate/25726/2 "2023-02-23T15:50:40Z")
Get the cert manually and add it to [`security.pki.certificates`](https://search.nixos.org/options?channel=22.11&show=security.pki.certificates&from=0&size=50&sort=relevance&type=packages&query=certificates) should do, unless I understand the problem statement wrong.
---
### Author:  [@nixinator](https://discourse.nixos.org/u/nixinator)
#### Post date: [February 23, 2023, 5:27pm UTC](https://discourse.nixos.org/t/install-root-certificate/25726/3 "2023-02-23T17:27:04Z")
So you want to Man in the middle your own network. Interesting. Burp is it?
---
### Author:  [@shmu26](https://discourse.nixos.org/u/shmu26)
#### Post date: [February 23, 2023, 5:53pm UTC](https://discourse.nixos.org/t/install-root-certificate/25726/4 "2023-02-23T17:53:22Z")
It is actually a content-filtering service. All your incoming internet traffic goes through them before it gets to you.
---
### Author:  [@nixinator](https://discourse.nixos.org/u/nixinator)
#### Post date: [February 23, 2023, 7:14pm UTC](https://discourse.nixos.org/t/install-root-certificate/25726/5 "2023-02-23T19:14:13Z")
Oh sounds interesting , what is this system?
---
### Author:  [@shmu26](https://discourse.nixos.org/u/shmu26)
#### Post date: [February 23, 2023, 7:31pm UTC](https://discourse.nixos.org/t/install-root-certificate/25726/6 "2023-02-23T19:31:40Z")
Not sure it will be super interesting to you…
Netfree
> **[נטפרי
(ע"ר)
-
דף הבית](https://netfree.link/)**
>
> נטפרי (ע"ר)
> מיזם ללא כוונת רווח
> העוסק בהצלת נפשות מסכנות האינטרנט
> באמצעות פתרונות טכנולוגים מ תקדמים
is a paid service for people who are not fond of seeing obscenity or hate or other bad stuff when they are browsing the internet. It is sort of like parental control, but for adults.
As you mentioned, this service in the middle of your internet traffic, so you need to trust them implicitly, but it works pretty well.
---
### Author:  [@shmu26](https://discourse.nixos.org/u/shmu26)
#### Post date: [March 22, 2023, 8:45am UTC](https://discourse.nixos.org/t/install-root-certificate/25726/7 "2023-03-22T08:45:05Z")
Okay, where do I find `security.pki.certificates` on my system? Is this a separate config file somewhere, or a section of a more general config file? Maybe it is a section I need to create in `nix.config`? 🤔
---
### Author:  [@NobbZ](https://discourse.nixos.org/u/NobbZ)
#### Post date: [March 22, 2023, 8:49am UTC](https://discourse.nixos.org/t/install-root-certificate/25726/8 "2023-03-22T08:49:22Z")
It is an option for the systems configuration as any other else.
---
### Author:  [@uep](https://discourse.nixos.org/u/uep)
#### Post date: [March 22, 2023, 9:08am UTC](https://discourse.nixos.org/t/install-root-certificate/25726/9 "2023-03-22T09:08:53Z")
e.g.
```nix
security.pki.certificates = [
''
-----BEGIN CERTIFICATE-----
MIIFCTCCAvGgAwIBAgIQZr …
…g3odD/oqxGnEFJwbaEnnNm5cafOTWeOLfbLEkq/TZC4oggetUAeTT
-----END CERTIFICATE-----
''
];
```
---
### Author:  [@shmu26](https://discourse.nixos.org/u/shmu26)
#### Post date: [March 22, 2023, 3:46pm UTC](https://discourse.nixos.org/t/install-root-certificate/25726/10 "2023-03-22T15:46:36Z")
That text snippet goes into my `nix.config`?
If so, where to put it? At the end, before the final `}`?
---
### Author:  [@shmu26](https://discourse.nixos.org/u/shmu26)
#### Post date: [March 22, 2023, 6:37pm UTC](https://discourse.nixos.org/t/install-root-certificate/25726/11 "2023-03-22T18:37:40Z")
Interesting that you put a semicolon after the closing bracket. Maybe that was my mistake, I omitted the semicolon.
For some reason, the official documentation also omits the semicolon:
[https://search.nixos.org/options?channel=22.11&show=security.pki.certificates&from=0&size=50&sort=relevance&type=packages&query=certificates](https://search.nixos.org/options?channel=22.11&show=security.pki.certificates&from=0&size=50&sort=relevance&type=packages&query=certificates)