diff --git a/pkgs/development/ocaml-modules/ca-certs/default.nix b/pkgs/development/ocaml-modules/ca-certs/default.nix
new file mode 100644
index 00000000000..136187e9d3c
--- /dev/null
+++ b/pkgs/development/ocaml-modules/ca-certs/default.nix
@@ -0,0 +1,29 @@
+{ lib, buildDunePackage, fetchurl
+, bos, fpath, rresult, ptime, mirage-crypto, x509
+}:
+
+buildDunePackage rec {
+  pname = "ca-certs";
+  version = "0.1.2";
+
+  minimumOCamlVersion = "4.07";
+
+  src = fetchurl {
+    url = "https://github.com/mirage/ca-certs/releases/download/v${version}/ca-certs-v${version}.tbz";
+    sha256 = "10bbqbrsqcmslz56zc5407knalh3kqypbm7lblnzzbidbapa9wpz";
+  };
+
+  useDune2 = true;
+
+  propagatedBuildInputs = [ bos fpath rresult ptime mirage-crypto x509 ];
+
+  # tests need access to network and systemwide ca cert chain
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Detect root CA certificates from the operating system";
+    maintainers = [ maintainers.sternenseemann ];
+    license = licenses.isc;
+    homepage = "https://github.com/mirage/ca-certs";
+  };
+}
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 7fd32142508..9cc95dd4f56 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -70,6 +70,8 @@ let
 
     bos = callPackage ../development/ocaml-modules/bos { };
 
+    ca-certs = callPackage ../development/ocaml-modules/ca-certs { };
+
     camlidl = callPackage ../development/tools/ocaml/camlidl { };
 
     camlp4 =