diff --git a/scripts/install-nix-from-closure.sh b/scripts/install-nix-from-closure.sh
index 9977dca2c..c9ba9a2a2 100644
--- a/scripts/install-nix-from-closure.sh
+++ b/scripts/install-nix-from-closure.sh
@@ -72,6 +72,12 @@ if ! $nix/bin/nix-env -i "$nix"; then
     exit 1
 fi
 
+# Install an SSL certificate bundle.
+if [ -z "$SSL_CERT_FILE" -o ! -f "$SSL_CERT_FILE" ]; then
+    $nix/bin/nix-env -i "$cacert"
+    export SSL_CERT_FILE="$HOME/.nix-profile/etc/ca-bundle.crt"
+fi
+
 # Subscribe the user to the Nixpkgs channel and fetch it.
 if ! $nix/bin/nix-channel --list | grep -q "^nixpkgs "; then
     $nix/bin/nix-channel --add https://nixos.org/channels/nixpkgs-unstable
@@ -80,11 +86,6 @@ if [ -z "$_NIX_INSTALLER_TEST" ]; then
     $nix/bin/nix-channel --update nixpkgs
 fi
 
-# Install an SSL certificate bundle.
-if [ -z "$SSL_CERT_FILE" ]; then
-    $nix/bin/nix-env -i "$cacert"
-fi
-
 # Make the shell source nix.sh during login.
 p=$NIX_LINK/etc/profile.d/nix.sh