Go comes with hardcoded cacert. We add the usual in NixOS,
for easier NixOS life.

diff -r 14854533dcc7 src/crypto/x509/root_unix.go
--- a/src/crypto/x509/root_unix.go	Thu Dec 11 11:27:56 2014 +1100
+++ b/src/crypto/x509/root_unix.go	Tue Jan 06 00:41:31 2015 -0600
@@ -17,6 +17,7 @@
 	"/usr/local/share/certs/ca-root-nss.crt", // FreeBSD/DragonFly
 	"/etc/pki/tls/cacert.pem",                // OpenELEC
 	"/etc/certs/ca-certificates.crt",         // Solaris 11.2+
+	"/etc/ssl/certs/ca-bundle.crt",           // NixOS
 }
 
 // Possible directories with certificate files; stop after successfully