diff --git a/pkgs/development/ocaml-modules/x509/default.nix b/pkgs/development/ocaml-modules/x509/default.nix
new file mode 100644
index 000000000000..6fdbbc346d92
--- /dev/null
+++ b/pkgs/development/ocaml-modules/x509/default.nix
@@ -0,0 +1,28 @@
+{ stdenv, fetchzip, ocaml, findlib, asn1-combinators, nocrypto, ounit }:
+
+let version = "0.4.0"; in
+
+stdenv.mkDerivation {
+  name = "ocaml-x509-${version}";
+
+  src = fetchzip {
+    url = "https://github.com/mirleft/ocaml-x509/archive/${version}.tar.gz";
+    sha256 = "0z4c19y625ipx2anpq25pzly1fdi3cklhk130kriybrczvmd2b29";
+  };
+
+  buildInputs = [ ocaml findlib ounit ];
+  propagatedBuildInputs = [ asn1-combinators nocrypto ];
+
+  configureFlags = "--enable-tests";
+  doCheck = true;
+  checkTarget = "test";
+  createFindlibDestdir = true;
+
+  meta = {
+    homepage = https://github.com/mirleft/ocaml-x509;
+    description = "X509 (RFC5280) handling in OCaml";
+    platforms = ocaml.meta.platforms;
+    license = stdenv.lib.licenses.bsd2;
+    maintainers = with stdenv.lib.maintainers; [ vbgl ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 341acaf3a360..95a17101120b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4656,6 +4656,8 @@ let
 
     vg = callPackage ../development/ocaml-modules/vg { };
 
+    x509 = callPackage ../development/ocaml-modules/x509 { };
+
     xmlm = callPackage ../development/ocaml-modules/xmlm { };
 
     xml-light = callPackage ../development/ocaml-modules/xml-light { };