Some applications requires contacting HTTPS endpoints. In those cases you need to supply the CA certificates.
Most Nix applications won't package in the CA certificates, this is because they can make use of the OS provided CA certificate store.
The NixOS location for this is at: /etc/ssl/certs
.
The OpenSSL library in Nixpkgs is compiled to use that path if there is no environment variables such as SSL_CERT_FILE
.