From b976ef503f345b8dd042b6b2dae1ad39f0a79ca0 Mon Sep 17 00:00:00 2001
From: "Burfeind, Jan-Niklas" <jan-niklas.burfeind@sennheiser.com>
Date: Fri, 5 Dec 2025 14:29:35 +0100
Subject: [PATCH] zscaler-cacert: init at 2025-02-02

---
 pkgs/by-name/zs/zscaler-cacert/package.nix | 36 ++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 pkgs/by-name/zs/zscaler-cacert/package.nix

diff --git a/pkgs/by-name/zs/zscaler-cacert/package.nix b/pkgs/by-name/zs/zscaler-cacert/package.nix
new file mode 100644
index 000000000000..1554b46e03d3
--- /dev/null
+++ b/pkgs/by-name/zs/zscaler-cacert/package.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "zscaler-cacert";
+
+  # check it on the DHL keyserver homepage ('validity period')
+  # and using openssl:
+  # openssl x509 -startdate -noout -in ZscalerRootCertificate-2048-SHA256.crt
+
+  version = "0-unstable-2025-02-02";
+
+  src = fetchurl {
+    url = "https://keyserver.dhl.com/pki/X3/ZscalerRootCertificate-2048-SHA256.crt";
+    hash = "sha256-HrQ7am1IteSP1O3mz3weay1NQG8aj3EUt1ZjYRbOEQA=";
+  };
+
+  dontUnpack = true;
+
+  dontBuild = true;
+
+  installPhase = ''
+    install -Dm644 $src $out/etc/ssl/certs/zscaler-ca.crt
+  '';
+
+  meta = {
+    description = "ZScaler Root CA certificate";
+    homepage = "https://keyserver.dhl.com/certificates";
+    license = lib.licenses.publicDomain;
+    maintainers = with lib.maintainers; [ aiyion ];
+    platforms = lib.platforms.all;
+  };
+}