diff --git a/pkgs/tools/security/der-ascii/default.nix b/pkgs/tools/security/der-ascii/default.nix
new file mode 100644
index 000000000000..2bfcc9c37095
--- /dev/null
+++ b/pkgs/tools/security/der-ascii/default.nix
@@ -0,0 +1,27 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "der-ascii";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "google";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1my93m1rx08kn2yms6k8w43byr8k61r1nra4b082j8b393wwxkqc";
+  };
+  vendorSha256 = null;
+
+  ldflags = [ "-s" "-w" ];
+
+  meta = with lib; {
+    description = ''
+      A small human-editable language to emit DER or BER encodings of ASN.1
+      structures and malformed variants of them
+    '';
+    homepage = "https://github.com/google/der-ascii";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ alexshpilkin cpu hawkw ];
+    mainProgram = "ascii2der"; # has stable output, unlike its inverse
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 929cdaf3ab50..38a420bdc565 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7407,6 +7407,8 @@ with pkgs;
 
   deluge-2_x = deluge;
 
+  der-ascii = callPackage ../tools/security/der-ascii { };
+
   desktop-file-utils = callPackage ../tools/misc/desktop-file-utils { };
 
   dfc  = callPackage ../tools/system/dfc { };