Force ca derivation sha change when new ca is generated.

lib/pki.nix

@@ -45,13 +45,24 @@
         hosts = "";
       };
     in
-      pkgs.runCommand "ca" {
+      pkgs.runCommand "initca" {
         buildInputs = [ pkgs.cfssl ];
       } '' cfssl genkey -initca ${ca_csr} | cfssljson -bare ca; \
            mkdir -p $out; cp *.pem $out'';
+
+   # make ca derivation sha depend on initca cfssl output
+   initca' = pkgs.stdenv.mkDerivation {
+    name = "ca";
+    src = initca;
+    buildCommand = ''
+      mkdir -p $out;
+      cp -r $src/* $out
+    '';
+  };
+
   ca = {
-    key = "${initca}/ca-key.pem";
-    cert = "${initca}/ca.pem";
+    key = "${initca'}/ca-key.pem";
+    cert = "${initca'}/ca.pem";
   };
 
   cfssl = conf: ''