I found a possible reason (but don’t know how to fix it). I ran nix develop -vvvvv to get “vomit”-level debugging info. I found that nix still has information about a file I once set as a test (I think even during installation). Back then I set NIX_SSL_CERT_FILE to point to <my-custom-cert>.pem (very illegal I know). I did this because the installer did not find the certificate as a test and it seems to have baked into nix.
I have now re-installed nix (uninstalled according to the instructions the installer provides), but the issue did not disappear and I can still see nix’s curl trying to use that value. Where could this come from? How could I get this removed?
$ nix develop -vvvvv
...
curl: Trying 151.101.2.217:443...
download thread waiting for 100 ms
curl: Connected to cache.nixos.org (151.101.2.217) port 443 (#0)
curl: ALPN: offers h2
curl: ALPN: offers http/1.1
curl: error setting certificate file: /usr/local/share/ca-certificates/<my-custom-cert>.pem
curl: Closing connection 0
finished download of 'https://cache.nixos.org/a169pn3ya9qhslncqiygzq7nfmljph0y.narinfo'; curl status = 77, HTTP status = 0, body = 0 bytes