Move setting $SSL_CERT_FILE to stdenv

Doing it in an openssl setup hook only works if packages have openssl
as a build input - it doesn't work if they're using a program linked
against openssl.

pkgs/development/libraries/openssl/default.nix

@@ -70,11 +70,6 @@ let
       fi
     '';
 
-    setupHook = builtins.toFile "openssl-setup-hook"
-      ''
-        export SSL_CERT_FILE=/no-cert-file.crt
-      '';
-
     crossAttrs = {
       # upstream patch: https://rt.openssl.org/Ticket/Display.html?id=2558
       postPatch = ''

pkgs/stdenv/generic/setup.sh

@@ -371,6 +371,11 @@ export NIX_BUILD_CORES
 paxmark() { true; }
 
 
+# Prevent OpenSSL-based applications from using certificates in
+# /etc/ssl.
+export SSL_CERT_FILE=/no-cert-file.crt
+
+
 ######################################################################
 # Textual substitution functions.