diff --git a/nixos/modules/services/networking/murmur.nix b/nixos/modules/services/networking/murmur.nix
index 5c0df8ca7960..692868c8a790 100644
--- a/nixos/modules/services/networking/murmur.nix
+++ b/nixos/modules/services/networking/murmur.nix
@@ -41,9 +41,9 @@ let
     ${lib.optionalString (cfg.registerHostname != "") "registerHostname=${cfg.registerHostname}"}
 
     certrequired=${lib.boolToString cfg.clientCertRequired}
-    ${lib.optionalString (cfg.sslCert != "") "sslCert=${cfg.sslCert}"}
-    ${lib.optionalString (cfg.sslKey != "") "sslKey=${cfg.sslKey}"}
-    ${lib.optionalString (cfg.sslCa != "") "sslCA=${cfg.sslCa}"}
+    ${lib.optionalString (cfg.sslCert != null) "sslCert=${cfg.sslCert}"}
+    ${lib.optionalString (cfg.sslKey != null) "sslKey=${cfg.sslKey}"}
+    ${lib.optionalString (cfg.sslCa != null) "sslCA=${cfg.sslCa}"}
 
     ${lib.optionalString (cfg.dbus != null) "dbus=${cfg.dbus}"}
 
@@ -238,20 +238,20 @@ in
       clientCertRequired = lib.mkEnableOption "requiring clients to authenticate via certificates";
 
       sslCert = lib.mkOption {
-        type = lib.types.str;
-        default = "";
+        type = lib.types.nullOr lib.types.path;
+        default = null;
         description = "Path to your SSL certificate.";
       };
 
       sslKey = lib.mkOption {
-        type = lib.types.str;
-        default = "";
+        type = lib.types.nullOr lib.types.path;
+        default = null;
         description = "Path to your SSL key.";
       };
 
       sslCa = lib.mkOption {
-        type = lib.types.str;
-        default = "";
+        type = lib.types.nullOr lib.types.path;
+        default = null;
         description = "Path to your SSL CA certificate.";
       };
 
@@ -418,13 +418,13 @@ in
     + lib.optionalString cfg.logToFile ''
       rw /var/log/murmur/murmurd.log,
     ''
-    + lib.optionalString (cfg.sslCert != "") ''
+    + lib.optionalString (cfg.sslCert != null) ''
       r ${cfg.sslCert},
     ''
-    + lib.optionalString (cfg.sslKey != "") ''
+    + lib.optionalString (cfg.sslKey != null) ''
       r ${cfg.sslKey},
     ''
-    + lib.optionalString (cfg.sslCa != "") ''
+    + lib.optionalString (cfg.sslCa != null) ''
       r ${cfg.sslCa},
     ''
     + lib.optionalString (cfg.dbus != null) ''