Installing any Nix package fails with Problem with the SSL CA cert (path? access rights?) (77)

[philiptaron]

Your OS (Linux, Mac) and architecture (x86_64, aarch64)

$ uname -a
Darwin vesper 22.6.0 Darwin Kernel Version 22.6.0: Wed Jul  5 22:17:35 PDT 2023; root:xnu-8796.141.3~6/RELEASE_ARM64_T8112 arm64

Your nix-installer version (/nix/nix-installer --version)

$ /nix/nix-installer --version
nix-installer 0.11.0

The thing you tried to run (eg nix-installer)
What happened (the output of the command, please)

$ nix profile install nixpkgs#curl
error: unable to download 'https://cache.nixos.org/g8bqlgmpa4yg601w561qy2n576i6g0vh.narinfo': Problem with the SSL CA cert (path? access rights?) (77)

Every other package also has this same issue.

What you expected to happen

No error and curl installed in my local profile.

If you tried to fix it, what did you try?

I tried to run dtruss but I didn't get anything meaningful.

$ sudo dtruss nix profile install nixpkgs#curl
dtrace: system integrity protection is on, some features will not be available

SYSCALL(args) 		 = return
warning: $HOME ('/Users/philip') is not owned by you, falling back to the one defined in the 'passwd' file ('/var/root')
error: unable to download 'https://channels.nixos.org/flake-registry.json': Problem with the SSL CA cert (path? access rights?) (77)

I see an open issue for the production Nix installer: NixOS/nix#876

[Hoverbear]

Any chance this machine used to have nix-darwin installed?

[philiptaron]

I don't think so, but it's possible. How would I know?

[Hoverbear]

The problem sounds extremely similar to what several users have previously reported. We did include a heuristic to detect nix-darwin in the newest version, but it's not surefire.

Maybe you could try this workaround? #449 (comment)

[philiptaron]

Sorry for the delay. /etc/static was indeed symlinked to somewhere in /nix. I followed the instructions to delete, but when I try to uninstall, I get this:

$ /nix/nix-installer uninstall
`nix-installer` needs to run as `root`, attempting to escalate now via `sudo`...
`nix-darwin` installation detected, it must be removed before uninstalling Nix. Please refer to https://github.com/LnL7/nix-darwin#uninstalling for instructions how to uninstall `nix-darwin`.

Which I can't do, since attempting to run nix-build https://github.com/LnL7/nix-darwin/archive/master.tar.gz -A uninstaller fails as before!

Hmm. Thorny!

[cole-h]

FWIW I was able to resolve this by doing the following:

sudo rm /Library/LaunchDaemons/org.nixos.activate-system.plist
sudo launchctl bootout system/org.nixos.activate-system
/nix/nix-installer uninstall
sudo rm /etc/ssl/certs/* # I forget the exact filename, sorry
# run the installer again

Hope this helps!

[philiptaron]

@cole-h, that resolved my issue! Thank you so much.

[nmrshll]

@cole-h Your solution seems to have worked for me. Thanks !