diff --git a/pkgs/by-name/ce/certificate-ripper/fix-test-temp-dir-path.patch b/pkgs/by-name/ce/certificate-ripper/fix-test-temp-dir-path.patch
new file mode 100644
index 000000000000..ff9b7d3bebd5
--- /dev/null
+++ b/pkgs/by-name/ce/certificate-ripper/fix-test-temp-dir-path.patch
@@ -0,0 +1,13 @@
+diff --git a/src/test/java/nl/altindag/crip/command/FileBaseTest.java b/src/test/java/nl/altindag/crip/command/FileBaseTest.java
+index 674ca10..f140601 100644
+--- a/src/test/java/nl/altindag/crip/command/FileBaseTest.java
++++ b/src/test/java/nl/altindag/crip/command/FileBaseTest.java
+@@ -26,7 +26,7 @@ import java.util.stream.Collectors;
+ 
+ public class FileBaseTest extends BaseTest {
+ 
+-    protected static final Path TEMP_DIRECTORY = Paths.get(System.getProperty("user.home"), "certificate-ripper-temp");
++    protected static final Path TEMP_DIRECTORY = Paths.get(System.getenv("TMP"), "certificate-ripper-temp");
+ 
+     @BeforeEach
+     void createTempDirAndClearConsoleCaptor() throws IOException {
diff --git a/pkgs/by-name/ce/certificate-ripper/make-deterministic.patch b/pkgs/by-name/ce/certificate-ripper/make-deterministic.patch
new file mode 100644
index 000000000000..b9e7aa1d0a1e
--- /dev/null
+++ b/pkgs/by-name/ce/certificate-ripper/make-deterministic.patch
@@ -0,0 +1,68 @@
+diff --git a/pom.xml b/pom.xml
+index dd0075d..46ac184 100644
+--- a/pom.xml
++++ b/pom.xml
+@@ -46,6 +46,7 @@
+         <version.license-maven-plugin>4.2.rc3</version.license-maven-plugin>
+         <license.git.copyrightYears>2021</license.git.copyrightYears>
+         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
++        <project.build.outputTimestamp>1980-01-01T00:00:02Z</project.build.outputTimestamp>
+     </properties>
+ 
+     <scm>
+@@ -103,6 +104,55 @@
+ 
+     <build>
+         <plugins>
++            <plugin>
++                <groupId>org.apache.maven.plugins</groupId>
++                <artifactId>maven-enforcer-plugin</artifactId>
++                <version>3.4.1</version>
++                <executions>
++                    <execution>
++                        <id>enforce-plugin-versions</id>
++                        <goals>
++                            <goal>enforce</goal>
++                        </goals>
++                        <configuration>
++                            <rules>
++                                <requirePluginVersions />
++                            </rules>
++                        </configuration>
++                    </execution>
++                </executions>
++            </plugin>
++            <plugin>
++                <groupId>org.apache.maven.plugins</groupId>
++                <artifactId>maven-deploy-plugin</artifactId>
++                <version>3.1.1</version>
++            </plugin>
++            <plugin>
++                <groupId>org.apache.maven.plugins</groupId>
++                <artifactId>maven-resources-plugin</artifactId>
++                <version>3.3.1</version>
++            </plugin>
++            <plugin>
++                <groupId>org.apache.maven.plugins</groupId>
++                <artifactId>maven-site-plugin</artifactId>
++                <version>4.0.0-M13</version>
++            </plugin>
++            <plugin>
++                <groupId>org.apache.maven.plugins</groupId>
++                <artifactId>maven-install-plugin</artifactId>
++                <version>3.1.1</version>
++            </plugin>
++            <plugin>
++                <groupId>org.apache.maven.plugins</groupId>
++                <artifactId>maven-clean-plugin</artifactId>
++                <version>3.3.2</version>
++            </plugin>
++            <plugin>
++                <groupId>org.apache.maven.plugins</groupId>
++                <artifactId>maven-jar-plugin</artifactId>
++                <version>3.3.0</version>
++            </plugin>
++
+             <plugin>
+                 <groupId>org.apache.maven.plugins</groupId>
+                 <artifactId>maven-compiler-plugin</artifactId>
diff --git a/pkgs/by-name/ce/certificate-ripper/package.nix b/pkgs/by-name/ce/certificate-ripper/package.nix
new file mode 100644
index 000000000000..0b03b395789f
--- /dev/null
+++ b/pkgs/by-name/ce/certificate-ripper/package.nix
@@ -0,0 +1,56 @@
+{ lib
+, maven
+, fetchFromGitHub
+, buildGraalvmNativeImage
+}:
+
+let
+  pname = "certificate-ripper";
+  version = "2.2.0";
+
+  jar = maven.buildMavenPackage {
+    pname = "${pname}-jar";
+    inherit version;
+
+    src = fetchFromGitHub {
+      owner = "Hakky54";
+      repo = "certificate-ripper";
+      rev = version;
+      hash = "sha256-snavZVLY8sHinLnG6k61eSQlR9sb8+k5tRHqu4kzQKM=";
+    };
+
+    patches = [
+      ./make-deterministic.patch
+      ./fix-test-temp-dir-path.patch
+    ];
+
+    mvnHash = "sha256-ahw9VVlvBPlWChcJzXFna55kxqVeJMmdaLtwWcJ+qSA=";
+
+    installPhase = ''
+      install -Dm644 target/crip.jar $out
+    '';
+  };
+in
+buildGraalvmNativeImage {
+  inherit pname version;
+
+  src = jar;
+
+  executable = "crip";
+
+  # Copied from pom.xml
+  extraNativeImageBuildArgs = [
+    "--no-fallback"
+    "-H:ReflectionConfigurationResources=graalvm_config.json"
+    "-H:EnableURLProtocols=https"
+    "-H:EnableURLProtocols=http"
+  ];
+
+  meta = {
+    changelog = "https://github.com/Hakky54/certificate-ripper/releases/tag/${version}";
+    description = "A CLI tool to extract server certificates";
+    homepage = "https://github.com/Hakky54/certificate-ripper";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ tomasajt ];
+  };
+}