# Updating \`ca-bundle.crt\` to be able to build requires up-to-date \`ca-bundle.crt\`
**URL:** https://discourse.nixos.org/t/updating-ca-bundle-crt-to-be-able-to-build-requires-up-to-date-ca-bundle-crt/80802
**Category:** Help
**Created:** [October 27, 2026, 6:02pm UTC](https://discourse.nixos.org/t/updating-ca-bundle-crt-to-be-able-to-build-requires-up-to-date-ca-bundle-crt/80802 "2026-10-27T18:02:10Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Pamplemousse](https://discourse.nixos.org/u/Pamplemousse)
#### Post date: [October 27, 2026, 6:02pm UTC](https://discourse.nixos.org/t/updating-ca-bundle-crt-to-be-able-to-build-requires-up-to-date-ca-bundle-crt/80802/1 "2026-10-27T18:02:10Z")
Welp: I am locked out of updating my machine…
```shell
nixos-rebuild switch --flake .#my-sad-machine
[...]
error: unable to download 'https://cache.nixos.org/nar/1v09jszprqkblf7ns99hp45rph5d6lsr5zyfxkx2m7n087q2rg9l.nar.zst': error adding trust anchors from file: /etc/ssl/certs/ca-certificates.crt (curl error code=77)
[... and mooooore...]
```
I haven’t updated this in a few days… Therefore, the trusted certificates list still shows the now infamous:
```shell
rg Comodo /etc/static/ssl/certs/ca-bundle.crt
1759:Comodo AAA Services root
```
I am assuming that it is causing trouble.
If I copy the file, edit it manually, then set `CURL_CA_BUNDLE`, and `NIX_SSL_CERT_FILE`… it seems that it is useless because of [SSL certificate path does not propagate to builds during `nix-build` · Issue #10783 · NixOS/nix · GitHub](https://github.com/NixOS/nix/issues/10783) .
Rebuilding (seems to) need an up-to-date `ca-bundle`, but updating the `ca-bundle` requires rebuilding… 🐔 🥚
Am I check mate?
---
### Author:  [@QuBe](https://discourse.nixos.org/u/QuBe)
#### Post date: [October 27, 2026, 6:08pm UTC](https://discourse.nixos.org/t/updating-ca-bundle-crt-to-be-able-to-build-requires-up-to-date-ca-bundle-crt/80802/2 "2026-10-27T18:08:51Z")
At worst there’s always `nixos-install` (see point 5 of the [manual](https://nixos.org/manual/nixos/stable/#sec-installation-manual-installing)) from something else ?
(Given your discourse flare, I assume you already know this, but might be useful to onlookers)
---
### Author:  [@winter](https://discourse.nixos.org/u/winter)
#### Post date: [October 27, 2026, 9:26pm UTC](https://discourse.nixos.org/t/updating-ca-bundle-crt-to-be-able-to-build-requires-up-to-date-ca-bundle-crt/80802/3 "2026-10-27T21:26:52Z")
I don’t _think_ any of the mitigations that were done would result in this, so a little confused. cc @hexa 👀
---
### Author:  [@hexa](https://discourse.nixos.org/u/hexa)
#### Post date: [October 27, 2026, 10:53pm UTC](https://discourse.nixos.org/t/updating-ca-bundle-crt-to-be-able-to-build-requires-up-to-date-ca-bundle-crt/80802/4 "2026-10-27T22:53:18Z")
Yeah, that seems unrelated to any of the ca-bundle changes we did recently.
I would recommend running `nix-store --verify --repair`, possibly even with `--check-contents` to rule out corruption.
---
### Author:  [@Pamplemousse](https://discourse.nixos.org/u/Pamplemousse)
#### Post date: [October 28, 2026, 7:57am UTC](https://discourse.nixos.org/t/updating-ca-bundle-crt-to-be-able-to-build-requires-up-to-date-ca-bundle-crt/80802/5 "2026-10-28T07:57:23Z")
> At worst there’s always `nixos-install` (see point 5 of the [manual](https://nixos.org/manual/nixos/stable/#sec-installation-manual-installing)) from something else ?
Yes, that was my last resort action.
A bit tedious, and not the “self-recovery” I hoped to be able to achieve.
---
### Author:  [@Pamplemousse](https://discourse.nixos.org/u/Pamplemousse)
#### Post date: [October 28, 2026, 8:02am UTC](https://discourse.nixos.org/t/updating-ca-bundle-crt-to-be-able-to-build-requires-up-to-date-ca-bundle-crt/80802/6 "2026-10-28T08:02:49Z")
Thanks @winter @hexa for jumping in.
In the end, I was able to unstuck myself by using another computer to build the system and copy the closure over SSH. After that, local builds worked fine.
For good measures, I ran
```shell
nix-store --verify --repair
nix-store --verify --repair --check-contents
```
which showed a bunch of:
```shell
path '/nix/store/037ni430ab9p42cplg3r3nwzgapalj17-python3.13-gssapi-1.10.1' disappeared, removing from database...
[... and many more...]
path '/nix/store/06v5dnvy7xfij23qywdiv9ilv559ija6-svelte-language-server-0.17.31' was modified! expected hash 'sha256-aWii1cn4uJoeEFxRuLPwwyYLz3nhmBcVFXcXERmBAnk=', got 'sha256-bx+aASSKs/FmOkuwDgL44en4aUlwlP6FIMrJBxk8sLw='
copying path '/nix/store/06v5dnvy7xfij23qywdiv9ilv559ija6-svelte-language-server-0.17.31' from 'https://cache.nixos.org'..
[... and many more...]
```
In the end, not exactly sure what happened, but it seems that I got back into a usable state 🤞
---
### Author:  [@wamserma](https://discourse.nixos.org/u/wamserma)
#### Post date: [October 28, 2026, 2:45pm UTC](https://discourse.nixos.org/t/updating-ca-bundle-crt-to-be-able-to-build-requires-up-to-date-ca-bundle-crt/80802/7 "2026-10-28T14:45:00Z")
Edit: Missed the second part of the theat. OP already went the route I was about to suggest.