Trusting CA certificates in Guix System

2026-08-15T11:43:00Z

I'm going to be honest. It took me frankly an embarassing amount of time to figure out how I could trust custom CA certificates in Guix System. I've been using it as my main operating system for almost a year at this point, and I only figured this out recently.

The core of my problem was (apart from not being very good at Scheme or Guix) that this wasn't clearly documented anywhere. Mainstream GNU/Linux distros have a clear way to do this. Just place the PEM encoded files under /usr/local/share/ca-certificates or /etc/pki/trust/anchors, or something similar, then run update-ca-certificates. The certificates will then be added to the system wide trust bundle, usually somewhere under /etc/ssl/certs. Even Nix, which Guix is originally forked from, has a short and very clear article about how to do this.

Guix just has this article: X.509 Certificates. Nowhere does it say how do actually ensure certificates end up in the systems trust bundle. It does mention the nss-certs package, which Guix installs by default to provide CA certs from Mozilla.

Being quite new to Scheme and Guix, I got way to hung up on this package. For some reason I was under the impressions that this package took care of actually generating the trust bundle at /etc/ssl/certs/ca-certificates.crt, which is does not. Turns out, I didn't need to care about nss-certs at all.

If we look at that file, it should be obvious.

$ ls -la /etc/ssl/certs/ca-certificates.crt
lrwxrwxrwx 1 root root 99  1 jan  1970 /etc/ssl/certs/ca-certificates.crt -> /gnu/store/l3y2wisv02pq1qkh6j101crr8bjs0xzr-ca-certificate-bundle/etc/ssl/certs/ca-certificates.crt

It's not even part of the nss-certs /gnu/store/ item!

Then I found another package, le-certs, a package for installing root and intermediate CA certs from Let's Encrypt, and at this point it became quite clear that I'd been an idiot. Turns out, you can just write a package that ensures some certificates files gets placed under /etc/ssl/certs and create the appropriate hash symlinks with c_rehash, then Guix will make sure those certs end up in the system trust bundle.

You can create a package definition anywhere, maybe just in your dotfiles repository, but I opted to create an actual channel since I wanted this package to me installed on both my PC's, and on my virtual machines (managed via a different central repository).

For reference, here is my Guix channel: https://git.sr.ht/~gunnargrop/guix-channel. And here is the tree output:

.
├── COPYING
├── gunnargrop
│   ├── auxillary
│   │   └── ca-certs
│   │       ├── gunnar-grop-ca.pem
│   │       └── home-internal-ca.pem
│   ├── packages
│   │   └── pki.scm
│   └── services
│       └── virtualization.scm
└── README.md

Here is what (gunnargrop packages pki) looks like:

(define-module (gunnargrop packages pki)
  #:use-module ((guix licenses) #:prefix license:)
  #:use-module (guix build-system trivial)
  #:use-module (guix packages)
  #:use-module (guix gexp)
  #:use-module (guix utils)
  #:use-module (gnu packages tls)
  #:use-module (gnu packages perl))

(define-public grop-certs
  (package
   (name "grop-certs")
   (version "1")
   (source #f)
   (build-system trivial-build-system)
   (inputs
    `(("gunnar-grop-root"
       ,(local-file "../auxillary/ca-certs/gunnar-grop-ca.pem"))
      ("home-internal-root"
       ,(local-file "../auxillary/ca-certs/home-internal-ca.pem"))))
   (native-inputs
    (list openssl perl))
   (arguments
    (list
     #:modules '((guix build utils))
     #:builder
     #~(begin
         (use-modules (guix build utils))

         (let ((out (string-append #$output "/etc/ssl/certs"))
               (openssl
                (assoc-ref %build-inputs "openssl"))
               (perl
                (assoc-ref %build-inputs "perl"))
               (gunnar-grop-root (assoc-ref %build-inputs "gunnar-grop-root"))
               (home-internal-root (assoc-ref %build-inputs "home-internal-root")))

           (mkdir-p out)
           (for-each
            (lambda (cert)
              (copy-file cert (string-append out "/"
                                             (strip-store-file-name cert))))
            (list gunnar-grop-root
                  home-internal-root))

           ;; Create hash symlinks suitable for OpenSSL ('SSL_CERT_DIR' and
           ;; similar.)
           (chdir out)
           (invoke (string-append perl "/bin/perl")
                   (string-append openssl "/bin/c_rehash")
                   ".")))))

   (home-page "https://grop.dev")
   (synopsis "Gunnar Grop CA certificates")
   (description
    "This package provides a certificate store containing my own
root and intermediate CA certificates.")
   (license license:public-domain)))

If you look at the le-certs package you can see that mine is basically a straight copy. The main difference being that my inputs (.pem files) come from local files, instead of being downloaded from the internet.

Anyway, after adding my own channel to /.config/guix/channels.scm I just added grop-certs to my systems packages definition:

(use-modules (gunnargrop packages pki))
; ...
(packages (append (list curl
                        grop-certs)
                  %base-packages))

And voilà! After a system reconfigure my CA certificates are present in the system trust bundle, and I can finally use curl without specifying CA files.

I hope whoever reads this finds it helpful, as I know I struggled with this particular part of Guix for a long time.

Fontconfig problems with Nix on Guix System

2026-07-20T16:49:00Z

Since I started using Guix System about a year ago, I've absolutely loved it. I can easily say it's my favourite OS out of any I've used, thus far. Although, compared to Nix (which Guix is based on), it has comparatively few software packages packaged for it. This is no wonder when considering the sheer amount of packages for Nix.

Fortunately this "problem" is easily remedied by just using Nix on Guix System! This is made extra easy by using the system service nix-service-type (documentation).

Now I use Nix on Guix System, mostly using Home Manager, and for the most parts it works great. One of the few problems I've run into is that graphical programs installed via Nix get the wrong fonts, like they couldn't find any fonts and always used a fallback. In this case, Iosevka, which I had installed with Guix. No matter which font packages I installed, every application would use Iosevka.

For example, Firefox (installed via Nix) would log this error whenever started:

Fontconfig error: Cannot load default config file: File not found:

Turns out that this is a problem with Fontconfig. Or rather, that Guix and Nix manages their Fontconfig configs differently. Guix System does not set the environment variables FONTCONFIG_FILE or FONTCONFIG_PATH, which are used by Fontconfig to figure out where configurations are placed. By default, Fontconfig looks in the directory /etc/fonts to find fonts and configs, but this is not where Guix places them. Guix instead places font configuration in the active system configuration directory, under /run/current-system/profile.

So, to fix the font problems with Nix applications, all we have to do is to set the following environment variables:

FONTCONFIG_PATH=/run/current-system/profile/etc/fonts
FONTCONFIG_FILE=/run/current-system/profile/etc/fonts/fonts.conf

In my case, I opted to do this in my Guix Home configuration, using the home-bash-service-type service, like so:

(home-environment
 (services
  (append (list (service home-bash-service-type
                         (home-bash-configuration
                          (environment-variables
                           '(("FONTCONFIG_FILE" . "/run/current-system/profile/etc/fonts/fonts.conf")
                             ("FONTCONFIG_PATH" . "/run/current-system/profile/etc/fonts")))))
                )
          %base-home-services)))

But you can set them however you like. After the environment variables are set, applications installed with Nix should find your installed fonts.