diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 669b4810f85..6300068f09f 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -70,11 +70,6 @@ let
       fi
     '';
 
-    setupHook = builtins.toFile "openssl-setup-hook"
-      ''
-        export SSL_CERT_FILE=/no-cert-file.crt
-      '';
-
     crossAttrs = {
       # upstream patch: https://rt.openssl.org/Ticket/Display.html?id=2558
       postPatch = ''
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 102a8f2f71c..dc6c765353f 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -371,6 +371,11 @@ export NIX_BUILD_CORES
 paxmark() { true; }
 
 
+# Prevent OpenSSL-based applications from using certificates in
+# /etc/ssl.
+export SSL_CERT_FILE=/no-cert-file.crt
+
+
 ######################################################################
 # Textual substitution functions.