diff --git a/pkgs/development/ocaml-modules/cohttp/async.nix b/pkgs/development/ocaml-modules/cohttp/async.nix
index 246397b608108..ac50e3f2bad89 100644
--- a/pkgs/development/ocaml-modules/cohttp/async.nix
+++ b/pkgs/development/ocaml-modules/cohttp/async.nix
@@ -1,5 +1,8 @@
-{ stdenv, buildDunePackage, async, cohttp, conduit-async, uri, ppx_sexp_conv
-, logs, magic-mime }:
+{ stdenv, buildDunePackage
+, async, cohttp, conduit-async, conduit-async-ssl
+, uri, logs, magic-mime, mirage-crypto, ipaddr
+, ounit, ppx_sexp_conv
+}:
 
 if !stdenv.lib.versionAtLeast cohttp.version "0.99" then
 	cohttp
@@ -14,7 +17,13 @@ else
 
 		buildInputs = [ ppx_sexp_conv ];
 
-		propagatedBuildInputs = [ async cohttp conduit-async logs magic-mime uri ];
+		propagatedBuildInputs = [
+			async cohttp conduit-async conduit-async-ssl logs magic-mime
+			uri mirage-crypto ipaddr
+		];
+
+		doCheck = true;
+		checkInputs = [ ounit ];
 
 		meta = cohttp.meta // {
 			description = "CoHTTP implementation for the Async concurrency library";
diff --git a/pkgs/development/ocaml-modules/cohttp/default.nix b/pkgs/development/ocaml-modules/cohttp/default.nix
index 3fed7c55d4521..49c3d26f93950 100644
--- a/pkgs/development/ocaml-modules/cohttp/default.nix
+++ b/pkgs/development/ocaml-modules/cohttp/default.nix
@@ -1,11 +1,11 @@
 { lib, fetchurl, buildDunePackage
-, ppx_fields_conv, ppx_sexp_conv, stdlib-shims
+, ppx_fields_conv, ppx_sexp_conv, ppx_compare, stdlib-shims
 , base64, fieldslib, jsonm, re, stringext, uri-sexp
 }:
 
 buildDunePackage rec {
 	pname = "cohttp";
-	version = "2.5.4";
+	version = "3.0.0";
 
 	useDune2 = true;
 
@@ -13,12 +13,12 @@ buildDunePackage rec {
 
 	src = fetchurl {
 		url = "https://github.com/mirage/ocaml-cohttp/releases/download/v${version}/cohttp-v${version}.tbz";
-		sha256 = "1q04spmki5zis5p5m1vs77i3k7ijm134j62g61071vblwx25z17a";
+		sha256 = "191fr2pxqydnmznx7fgc2hk4lyffrf6c2al2pcvc7jdbg91jz1zv";
 	};
 
 	buildInputs = [ jsonm ppx_fields_conv ppx_sexp_conv ];
 
-	propagatedBuildInputs = [ base64 fieldslib re stringext uri-sexp stdlib-shims ];
+	propagatedBuildInputs = [ base64 fieldslib re stringext uri-sexp stdlib-shims ppx_compare ];
 
 	meta = {
 		description = "HTTP(S) library for Lwt, Async and Mirage";
diff --git a/pkgs/development/ocaml-modules/cohttp/lwt-unix-nossl.nix b/pkgs/development/ocaml-modules/cohttp/lwt-unix-nossl.nix
new file mode 100644
index 0000000000000..5e7acd9d48094
--- /dev/null
+++ b/pkgs/development/ocaml-modules/cohttp/lwt-unix-nossl.nix
@@ -0,0 +1,23 @@
+{ buildDunePackage, cohttp-lwt
+, conduit-lwt, cmdliner, magic-mime, logs, fmt, ocaml_lwt, ca-certs
+, ounit
+}:
+
+buildDunePackage {
+  pname = "cohttp-lwt-unix-nossl";
+
+  minimumOCamlVersion = "4.08";
+
+  inherit (cohttp-lwt) src version useDune2;
+
+  propagatedBuildInputs = [
+    cohttp-lwt conduit-lwt ca-certs cmdliner magic-mime logs fmt ocaml_lwt
+  ];
+
+  doCheck = true;
+  checkInputs = [ ounit ];
+
+  meta = cohttp-lwt.meta // {
+    description = "CoHTTP implementation for Unix and Windows using Lwt";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/cohttp/lwt-unix-ssl.nix b/pkgs/development/ocaml-modules/cohttp/lwt-unix-ssl.nix
new file mode 100644
index 0000000000000..20abe57794525
--- /dev/null
+++ b/pkgs/development/ocaml-modules/cohttp/lwt-unix-ssl.nix
@@ -0,0 +1,25 @@
+{ buildDunePackage, cohttp-lwt, cohttp-lwt-unix-nossl
+, conduit-lwt, conduit-lwt-ssl, ca-certs, cmdliner
+, magic-mime, logs, fmt, ocaml_lwt
+, ounit
+}:
+
+buildDunePackage {
+  pname = "cohttp-lwt-unix-ssl";
+
+  minimumOCamlVersion = "4.08";
+
+  inherit (cohttp-lwt) src version useDune2;
+
+  propagatedBuildInputs = [
+    cohttp-lwt cohttp-lwt-unix-nossl conduit-lwt conduit-lwt-ssl
+    ca-certs cmdliner magic-mime logs fmt ocaml_lwt
+  ];
+
+  doCheck = true;
+  checkInputs = [ ounit ];
+
+  meta = cohttp-lwt.meta // {
+    description = "CoHTTP implementation for Unix and Windows using Lwt";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/cohttp/lwt-unix.nix b/pkgs/development/ocaml-modules/cohttp/lwt-unix.nix
index 3a99ed9536f03..a3c2f21ce7f5d 100644
--- a/pkgs/development/ocaml-modules/cohttp/lwt-unix.nix
+++ b/pkgs/development/ocaml-modules/cohttp/lwt-unix.nix
@@ -1,19 +1,27 @@
-{ stdenv, buildDunePackage, cohttp-lwt
-, conduit-lwt-unix, ppx_sexp_conv
-, cmdliner, fmt, magic-mime
+{ lib, buildDunePackage, cohttp-lwt, cohttp-lwt-unix-nossl
+, conduit-lwt, conduit-lwt-tls, ca-certs
+, cmdliner, magic-mime, logs, fmt, ocaml_lwt
 }:
 
-if !stdenv.lib.versionAtLeast cohttp-lwt.version "0.99"
+if !lib.versionAtLeast cohttp-lwt.version "0.99"
 then cohttp-lwt
 else
 
 buildDunePackage {
 	pname = "cohttp-lwt-unix";
-	inherit (cohttp-lwt) version src meta;
+	inherit (cohttp-lwt) version src useDune2;
 
-	useDune2 = true;
+	minimumOCamlVersion = "4.08";
 
-	buildInputs = [ cmdliner ppx_sexp_conv ];
+	propagatedBuildInputs = [
+		cohttp-lwt cohttp-lwt-unix-nossl conduit-lwt conduit-lwt-tls ca-certs
+		cmdliner magic-mime logs fmt ocaml_lwt
+	];
 
-	propagatedBuildInputs = [ cohttp-lwt conduit-lwt-unix fmt magic-mime ];
+	# requires system trust anchor not available in sandbox
+	doCheck = false;
+
+	meta = cohttp-lwt.meta // {
+		description = "CoHTTP implementation for Unix and Windows using Lwt";
+	};
 }
diff --git a/pkgs/development/ocaml-modules/cohttp/lwt.nix b/pkgs/development/ocaml-modules/cohttp/lwt.nix
index 8357d748ce8f9..7b5673895f68d 100644
--- a/pkgs/development/ocaml-modules/cohttp/lwt.nix
+++ b/pkgs/development/ocaml-modules/cohttp/lwt.nix
@@ -1,4 +1,7 @@
-{ stdenv, buildDunePackage, cohttp, ocaml_lwt, uri, ppx_sexp_conv, logs }:
+{ stdenv, buildDunePackage
+, cohttp, ocaml_lwt, uri, logs
+, ppx_sexp_conv
+}:
 
 if !stdenv.lib.versionAtLeast cohttp.version "0.99"
 then cohttp
@@ -10,7 +13,7 @@ buildDunePackage {
 	pname = "cohttp-lwt";
 	inherit (cohttp) version src useDune2 meta;
 
-	buildInputs = [ uri ppx_sexp_conv ];
+	buildInputs = [ ppx_sexp_conv ];
 
-	propagatedBuildInputs = [ cohttp ocaml_lwt logs ];
+	propagatedBuildInputs = [ cohttp ocaml_lwt logs uri ];
 }
diff --git a/pkgs/development/ocaml-modules/conduit/async-ssl.nix b/pkgs/development/ocaml-modules/conduit/async-ssl.nix
new file mode 100644
index 0000000000000..ade6ea5f8334e
--- /dev/null
+++ b/pkgs/development/ocaml-modules/conduit/async-ssl.nix
@@ -0,0 +1,15 @@
+{ buildDunePackage, conduit
+, conduit-async, async, async_ssl, core
+}:
+
+buildDunePackage {
+  pname = "conduit-async-ssl";
+
+  inherit (conduit) src version useDune2 minimumOCamlVersion;
+
+  propagatedBuildInputs = [ conduit-async async async_ssl core ];
+
+  meta = conduit.meta // {
+    description = "A portable network connection establishment library using Async and OpenSSL";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/conduit/async-tls.nix b/pkgs/development/ocaml-modules/conduit/async-tls.nix
new file mode 100644
index 0000000000000..6126c4c73706f
--- /dev/null
+++ b/pkgs/development/ocaml-modules/conduit/async-tls.nix
@@ -0,0 +1,15 @@
+{ buildDunePackage, conduit
+, conduit-async, conduit-tls, async, core
+}:
+
+buildDunePackage {
+  pname = "conduit-async-tls";
+
+  inherit (conduit) src version useDune2 minimumOCamlVersion;
+
+  propagatedBuildInputs = [ conduit-async conduit-tls async core ];
+
+  meta = conduit.meta // {
+    description = "A portable network connection establishment library using Async and ocaml-tls";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/conduit/async.nix b/pkgs/development/ocaml-modules/conduit/async.nix
index f16819ed8aefe..bb3050a8cc0b4 100644
--- a/pkgs/development/ocaml-modules/conduit/async.nix
+++ b/pkgs/development/ocaml-modules/conduit/async.nix
@@ -1,17 +1,20 @@
-{ stdenv, buildDunePackage, async, async_ssl, ppx_sexp_conv, conduit }:
+{ lib, buildDunePackage
+, async, core, conduit, cstruct
+, ke, fmt, bigstringaf, rresult
+}:
 
-if !stdenv.lib.versionAtLeast conduit.version "1.0"
+if !lib.versionAtLeast conduit.version "1.0"
 then conduit
 else
 
 buildDunePackage {
 	pname = "conduit-async";
-	useDune2 = true;
-	inherit (conduit) version src;
+	inherit (conduit) version src useDune2;
 
-	buildInputs = [ ppx_sexp_conv ];
+	propagatedBuildInputs = [ core async conduit cstruct ];
 
-	propagatedBuildInputs = [ async async_ssl conduit ];
+	doCheck = true;
+	checkInputs = [ ke fmt bigstringaf rresult ];
 
 	meta = conduit.meta // {
 		description = "A network connection establishment library for Async";
diff --git a/pkgs/development/ocaml-modules/conduit/default.nix b/pkgs/development/ocaml-modules/conduit/default.nix
index 27b2a329b26e5..7a4029824e20d 100644
--- a/pkgs/development/ocaml-modules/conduit/default.nix
+++ b/pkgs/development/ocaml-modules/conduit/default.nix
@@ -1,21 +1,26 @@
 { stdenv, fetchurl, buildDunePackage
-, ppx_sexp_conv, sexplib, astring, uri, logs
-, ipaddr, ipaddr-sexp
+, stdlib-shims, ipaddr, domain-name
+, rresult, alcotest
 }:
 
 buildDunePackage rec {
   pname = "conduit";
-  version = "2.2.2";
+  version = "3.0.0";
 
   minimumOCamlVersion = "4.07";
 
+  useDune2 = true;
+
   src = fetchurl {
-    url = "https://github.com/mirage/ocaml-conduit/releases/download/v2.2.2/conduit-v2.2.2.tbz";
-    sha256 = "1zb83w2pq9c8xrappfxa6y5q93772f5dj22x78camsm77a2c2z55";
+    url = "https://github.com/mirage/ocaml-conduit/releases/download/v${version}/conduit-v${version}.tbz";
+    sha256 = "1fyd6d00arf8pisddia7sk6jlhdrp0d37lh9zjsj5ip892812l4b";
   };
 
-  buildInputs = [ ppx_sexp_conv ];
-  propagatedBuildInputs = [ astring ipaddr ipaddr-sexp sexplib uri ];
+  buildInputs = [ stdlib-shims ];
+  propagatedBuildInputs = [ ipaddr domain-name ];
+
+  doCheck = true;
+  checkInputs = [ rresult alcotest ];
 
   meta = {
     description = "A network connection establishment library";
diff --git a/pkgs/development/ocaml-modules/conduit/lwt-ssl.nix b/pkgs/development/ocaml-modules/conduit/lwt-ssl.nix
new file mode 100644
index 0000000000000..ee211bd7c2818
--- /dev/null
+++ b/pkgs/development/ocaml-modules/conduit/lwt-ssl.nix
@@ -0,0 +1,13 @@
+{ buildDunePackage, conduit, conduit-lwt, lwt_ssl }:
+
+buildDunePackage {
+  pname = "conduit-lwt-ssl";
+
+  inherit (conduit) src version useDune2 minimumOCamlVersion;
+
+  propagatedBuildInputs = [ conduit-lwt lwt_ssl ];
+
+  meta = conduit.meta // {
+    description = "A portable network connection establishment library using Lwt and OpenSSL";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/conduit/lwt-tls.nix b/pkgs/development/ocaml-modules/conduit/lwt-tls.nix
new file mode 100644
index 0000000000000..f7c7a4dbe7832
--- /dev/null
+++ b/pkgs/development/ocaml-modules/conduit/lwt-tls.nix
@@ -0,0 +1,15 @@
+{ buildDunePackage, conduit
+, conduit-lwt, conduit-tls, mirage-crypto-rng
+}:
+
+buildDunePackage {
+  pname = "conduit-lwt-tls";
+
+  inherit (conduit) src version useDune2 minimumOCamlVersion;
+
+  propagatedBuildInputs = [ conduit-lwt conduit-tls mirage-crypto-rng ];
+
+  meta = conduit.meta // {
+    description = "A portable network connection establishment library using Lwt and ocaml-tls";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/conduit/lwt-unix.nix b/pkgs/development/ocaml-modules/conduit/lwt-unix.nix
deleted file mode 100644
index b3c7e7fa86f9e..0000000000000
--- a/pkgs/development/ocaml-modules/conduit/lwt-unix.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{ stdenv, buildDunePackage
-, conduit-lwt, ppx_sexp_conv, ocaml_lwt, uri, ipaddr, ipaddr-sexp
-, lwt_ssl, tls
-}:
-
-buildDunePackage {
-	pname = "conduit-lwt-unix";
-	inherit (conduit-lwt) version src minimumOCamlVersion;
-
-	useDune2 = true;
-
-	buildInputs = [ ppx_sexp_conv ];
-
-	propagatedBuildInputs =
-		[ conduit-lwt ocaml_lwt uri ipaddr ipaddr-sexp tls lwt_ssl ];
-
-	meta = conduit-lwt.meta // {
-		description = "A network connection establishment library for Lwt_unix";
-	};
-}
diff --git a/pkgs/development/ocaml-modules/conduit/lwt.nix b/pkgs/development/ocaml-modules/conduit/lwt.nix
index 9bcd98e06a49e..31102bafad3bb 100644
--- a/pkgs/development/ocaml-modules/conduit/lwt.nix
+++ b/pkgs/development/ocaml-modules/conduit/lwt.nix
@@ -1,12 +1,16 @@
-{ stdenv, buildDunePackage, ppx_sexp_conv, conduit, ocaml_lwt, sexplib }:
+{ buildDunePackage
+, conduit, ocaml_lwt, cstruct
+, ke, fmt, rresult, bigstringaf
+}:
 
 buildDunePackage {
 	pname = "conduit-lwt";
-	inherit (conduit) version src minimumOCamlVersion;
+	inherit (conduit) version src minimumOCamlVersion useDune2;
 
-	buildInputs = [ ppx_sexp_conv ];
+	propagatedBuildInputs = [ conduit cstruct ocaml_lwt ];
 
-	propagatedBuildInputs = [ conduit ocaml_lwt sexplib ];
+	doCheck = true;
+	checkInputs = [ ke fmt rresult bigstringaf ];
 
 	meta = conduit.meta // {
 		description = "A network connection establishment library for Lwt";
diff --git a/pkgs/development/ocaml-modules/conduit/mirage.nix b/pkgs/development/ocaml-modules/conduit/mirage.nix
new file mode 100644
index 0000000000000..1d8863a14f01a
--- /dev/null
+++ b/pkgs/development/ocaml-modules/conduit/mirage.nix
@@ -0,0 +1,16 @@
+{ buildDunePackage, conduit
+}:
+
+buildDunePackage {
+  pname = "conduit-mirage";
+
+  inherit (conduit) src version useDune2 minimumOCamlVersion;
+
+  propagatedBuildInputs = [
+    ke tcpip mirage-flow mirage-time dns-client ke bigstringaf
+  ];
+
+  meta = conduit.meta // {
+    description = "A network connection establishment library for MirageOS";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/conduit/tls.nix b/pkgs/development/ocaml-modules/conduit/tls.nix
new file mode 100644
index 0000000000000..b15aefb3adb7c
--- /dev/null
+++ b/pkgs/development/ocaml-modules/conduit/tls.nix
@@ -0,0 +1,15 @@
+{ buildDunePackage, conduit
+, ke, tls, logs, bigstringaf
+}:
+
+buildDunePackage {
+  pname = "conduit-tls";
+
+  inherit (conduit) src version useDune2 minimumOCamlVersion;
+
+  propagatedBuildInputs = [ conduit ke tls logs bigstringaf ];
+
+  meta = conduit.meta // {
+    description = "A network connection establishment library with TLS/SSL support";
+  };
+}
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 9cc95dd4f56be..ae8159dcde110 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -139,13 +139,25 @@ let
 
     cohttp-lwt-unix = callPackage ../development/ocaml-modules/cohttp/lwt-unix.nix { };
 
+    cohttp-lwt-unix-nossl = callPackage ../development/ocaml-modules/cohttp/lwt-unix-nossl.nix { };
+
+    cohttp-lwt-unix-ssl = callPackage ../development/ocaml-modules/cohttp/lwt-unix-ssl.nix { };
+
     conduit = callPackage ../development/ocaml-modules/conduit { };
 
     conduit-async = callPackage ../development/ocaml-modules/conduit/async.nix { };
 
+    conduit-async-ssl = callPackage ../development/ocaml-modules/conduit/async-ssl.nix { };
+
+    conduit-async-tls = callPackage ../development/ocaml-modules/conduit/async-tls.nix { };
+
     conduit-lwt = callPackage ../development/ocaml-modules/conduit/lwt.nix { };
 
-    conduit-lwt-unix = callPackage ../development/ocaml-modules/conduit/lwt-unix.nix { };
+    conduit-lwt-ssl = callPackage ../development/ocaml-modules/conduit/lwt-ssl.nix { };
+
+    conduit-lwt-tls = callPackage ../development/ocaml-modules/conduit/lwt-tls.nix { };
+
+    conduit-tls = callPackage ../development/ocaml-modules/conduit/tls.nix { };
 
     config-file = callPackage ../development/ocaml-modules/config-file { };