@shlevy, thanks for your PR! By analyzing the history of the files in this pull request, we identified @edolstra, @ikervagyok and @vcunat to be potential reviewers.

If this is acceptable I'd like to get it in 16.09 and 17.03 as well

Why would NixOS releases make a difference to Darwin stuff? Otherwise it looks fine

@copumpkin Because we have some users who use those as stable nix channels.

I hope not, I thought that darwin fixes where never ported to release branches.

OK, I'll tell them to switch to unstable

Doesn't this collide with @edolstra patch at #23605

Not really, no. This is for cases where the env var isn't set at all. If it is, nix indeed overrides the default cert path already.

So this is for the cases when Nix profile is not sourced? Makes sense. But we'd need to patch git, etc as well then.