SSL CA cert error on MacOS

Help
1

Have you ever seen this error in Nix (MacOS Ventura 13.4.1 (c) (22F770820d)):

% nix run nix-darwin -- switch --flake ~/.config/nix-darwin warning: cannot read flake registry '/etc/nix/registry.json': error: opening file '/etc/nix/registry.json': No such file or directory
error: unable to download 'https://cache.nixos.org/nar/1wy0f953cqm34w2sh4n0jhggrlsyvnpx7mdpqhbxnbfr0yg8w8b2.nar.xz': Problem with the SSL CA cert (path? access rights?) (77)

% nix-shell
warning: cannot read flake registry '/etc/nix/registry.json': error: opening file '/etc/nix/registry.json': No such file or directory
error: unable to download 'https://cache.nixos.org/rwpiwxha1h6lii6dkz651jx16z9c5qzw.narinfo': Problem with the SSL CA cert (path? access rights?) (77)

% nix develop
error: unable to download 'https://cache.nixos.org/xqpx4n6h53qgyjxrn3i29rx0zhr9pc8q.narinfo': Problem with the SSL CA cert (path? access rights?) (77)

This happens whenever I run a Nix command.
All the projects above work on other machines (Nix on Windows WSL and NixOS).
Only on this Mac Machine it stopped working.

I used the DeterminateSystems installer 1. Get Nix running on your system this time, however, I do believe this error has nothing to do with the installer but Nix.
The first time (installed Nix with Nix default installer) I tried multiple fixes and nothing worked so I formatted the Mac and installed Nix with DeterminateSystems installer.
I do not know how to reproduce, but this happened twice on this machine.
This happened after a couple of days of not turning on the machine, before that it was working and no change (that I remember) was made.

I looked on issues on Nix, the DeterminateSystems installer, nix-darwin, etc. The most relevant is this one Multi-user installation on OSX - SSL cert problem for user, not for root · Issue #2899 · NixOS/nix · GitHub but I am not sure if it is related and the solutions do not work. Appears to be the same as this issue: Nix run error: Problem with the SSL CA cert but the solution did not work for me.

Have you ever experience or seen anyone have this issue?

2

The solution on the other post does not work, because:

3

We coincidentally had an installer workgroup meeting this morning and I asked about this. The developer on the detsys installer thinks this sounds like some reports they have about trouble caused by uninstalling Nix without uninstalling nix-darwin first, and having some of nix-darwin’s artifacts/changes dangling.

If that sounds like it might describe your case, you may need to manually uninstall nix-darwin. Judging from Uninstall nix-darwin manually · Issue #542 · LnL7/nix-darwin · GitHub, it sounds like there’s heavy emphasis on the manually bit. (I haven’t looked around further to see if there is a clear set of manual instructions out there…)

4

The SSL error started before trying to reinstall anything. I had indeed nix-darwin installed (pretty sure both times the error appear it was installed).

Will uninstall nix-darwin manually and then update the post with the results.

5

Solved it, for more info go to Error reinstalling Nix on MacOS (error: failed to configure synthetic.conf) · Issue #8771 · NixOS/nix · GitHub

However, the solution was fixing a dead symlink as stated in Problems with multi-user (re)installation of nix on macOS · Issue #3261 · NixOS/nix · GitHub

Check for an old symlink like this:

ls -la /etc/ssl/certs/ca-certificates.crt

If you have it (e.g. pointing to /etc/static/ssl/certs/ca-certificates.crt, remove and create a new one.

TL;DR: Try this

sudo rm /etc/ssl/certs/ca-certificates.crt
sudo ln -s /nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt /etc/ssl/certs/ca-certificates.crt

Thank you @abathur and everyone else for the help.

3 Likes