diff --git a/pkgs/development/ocaml-modules/cohttp/async.nix b/pkgs/development/ocaml-modules/cohttp/async.nix
index 246397b608108..ac50e3f2bad89 100644
--- a/pkgs/development/ocaml-modules/cohttp/async.nix
+++ b/pkgs/development/ocaml-modules/cohttp/async.nix
@@ -1,5 +1,8 @@
-{ stdenv, buildDunePackage, async, cohttp, conduit-async, uri, ppx_sexp_conv
-, logs, magic-mime }:
+{ stdenv, buildDunePackage
+, async, cohttp, conduit-async, conduit-async-ssl
+, uri, logs, magic-mime, mirage-crypto, ipaddr
+, ounit, ppx_sexp_conv
+}:
 
 if !stdenv.lib.versionAtLeast cohttp.version "0.99" then
 	cohttp
@@ -14,7 +17,13 @@ else
 
 		buildInputs = [ ppx_sexp_conv ];
 
-		propagatedBuildInputs = [ async cohttp conduit-async logs magic-mime uri ];
+		propagatedBuildInputs = [
+			async cohttp conduit-async conduit-async-ssl logs magic-mime
+			uri mirage-crypto ipaddr
+		];
+
+		doCheck = true;
+		checkInputs = [ ounit ];
 
 		meta = cohttp.meta // {
 			description = "CoHTTP implementation for the Async concurrency library";
diff --git a/pkgs/development/ocaml-modules/cohttp/default.nix b/pkgs/development/ocaml-modules/cohttp/default.nix
index 3fed7c55d4521..49c3d26f93950 100644
--- a/pkgs/development/ocaml-modules/cohttp/default.nix
+++ b/pkgs/development/ocaml-modules/cohttp/default.nix
@@ -1,11 +1,11 @@
 { lib, fetchurl, buildDunePackage
-, ppx_fields_conv, ppx_sexp_conv, stdlib-shims
+, ppx_fields_conv, ppx_sexp_conv, ppx_compare, stdlib-shims
 , base64, fieldslib, jsonm, re, stringext, uri-sexp
 }:
 
 buildDunePackage rec {
 	pname = "cohttp";
-	version = "2.5.4";
+	version = "3.0.0";
 
 	useDune2 = true;
 
@@ -13,12 +13,12 @@ buildDunePackage rec {
 
 	src = fetchurl {
 		url = "https://github.com/mirage/ocaml-cohttp/releases/download/v${version}/cohttp-v${version}.tbz";
-		sha256 = "1q04spmki5zis5p5m1vs77i3k7ijm134j62g61071vblwx25z17a";
+		sha256 = "191fr2pxqydnmznx7fgc2hk4lyffrf6c2al2pcvc7jdbg91jz1zv";
 	};
 
 	buildInputs = [ jsonm ppx_fields_conv ppx_sexp_conv ];
 
-	propagatedBuildInputs = [ base64 fieldslib re stringext uri-sexp stdlib-shims ];
+	propagatedBuildInputs = [ base64 fieldslib re stringext uri-sexp stdlib-shims ppx_compare ];
 
 	meta = {
 		description = "HTTP(S) library for Lwt, Async and Mirage";
diff --git a/pkgs/development/ocaml-modules/cohttp/lwt-unix-nossl.nix b/pkgs/development/ocaml-modules/cohttp/lwt-unix-nossl.nix
new file mode 100644
index 0000000000000..5e7acd9d48094
--- /dev/null
+++ b/pkgs/development/ocaml-modules/cohttp/lwt-unix-nossl.nix
@@ -0,0 +1,23 @@
+{ buildDunePackage, cohttp-lwt
+, conduit-lwt, cmdliner, magic-mime, logs, fmt, ocaml_lwt, ca-certs
+, ounit
+}:
+
+buildDunePackage {
+  pname = "cohttp-lwt-unix-nossl";
+
+  minimumOCamlVersion = "4.08";
+
+  inherit (cohttp-lwt) src version useDune2;
+
+  propagatedBuildInputs = [
+    cohttp-lwt conduit-lwt ca-certs cmdliner magic-mime logs fmt ocaml_lwt
+  ];
+
+  doCheck = true;
+  checkInputs = [ ounit ];
+
+  meta = cohttp-lwt.meta // {
+    description = "CoHTTP implementation for Unix and Windows using Lwt";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/cohttp/lwt-unix-ssl.nix b/pkgs/development/ocaml-modules/cohttp/lwt-unix-ssl.nix
new file mode 100644
index 0000000000000..20abe57794525
--- /dev/null
+++ b/pkgs/development/ocaml-modules/cohttp/lwt-unix-ssl.nix
@@ -0,0 +1,25 @@
+{ buildDunePackage, cohttp-lwt, cohttp-lwt-unix-nossl
+, conduit-lwt, conduit-lwt-ssl, ca-certs, cmdliner
+, magic-mime, logs, fmt, ocaml_lwt
+, ounit
+}:
+
+buildDunePackage {
+  pname = "cohttp-lwt-unix-ssl";
+
+  minimumOCamlVersion = "4.08";
+
+  inherit (cohttp-lwt) src version useDune2;
+
+  propagatedBuildInputs = [
+    cohttp-lwt cohttp-lwt-unix-nossl conduit-lwt conduit-lwt-ssl
+    ca-certs cmdliner magic-mime logs fmt ocaml_lwt
+  ];
+
+  doCheck = true;
+  checkInputs = [ ounit ];
+
+  meta = cohttp-lwt.meta // {
+    description = "CoHTTP implementation for Unix and Windows using Lwt";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/cohttp/lwt-unix.nix b/pkgs/development/ocaml-modules/cohttp/lwt-unix.nix
index 3a99ed9536f03..a3c2f21ce7f5d 100644
--- a/pkgs/development/ocaml-modules/cohttp/lwt-unix.nix
+++ b/pkgs/development/ocaml-modules/cohttp/lwt-unix.nix
@@ -1,19 +1,27 @@
-{ stdenv, buildDunePackage, cohttp-lwt
-, conduit-lwt-unix, ppx_sexp_conv
-, cmdliner, fmt, magic-mime
+{ lib, buildDunePackage, cohttp-lwt, cohttp-lwt-unix-nossl
+, conduit-lwt, conduit-lwt-tls, ca-certs
+, cmdliner, magic-mime, logs, fmt, ocaml_lwt
 }:
 
-if !stdenv.lib.versionAtLeast cohttp-lwt.version "0.99"
+if !lib.versionAtLeast cohttp-lwt.version "0.99"
 then cohttp-lwt
 else
 
 buildDunePackage {
 	pname = "cohttp-lwt-unix";
-	inherit (cohttp-lwt) version src meta;
+	inherit (cohttp-lwt) version src useDune2;
 
-	useDune2 = true;
+	minimumOCamlVersion = "4.08";
 
-	buildInputs = [ cmdliner ppx_sexp_conv ];
+	propagatedBuildInputs = [
+		cohttp-lwt cohttp-lwt-unix-nossl conduit-lwt conduit-lwt-tls ca-certs
+		cmdliner magic-mime logs fmt ocaml_lwt
+	];
 
-	propagatedBuildInputs = [ cohttp-lwt conduit-lwt-unix fmt magic-mime ];
+	# requires system trust anchor not available in sandbox
+	doCheck = false;
+
+	meta = cohttp-lwt.meta // {
+		description = "CoHTTP implementation for Unix and Windows using Lwt";
+	};
 }
diff --git a/pkgs/development/ocaml-modules/cohttp/lwt.nix b/pkgs/development/ocaml-modules/cohttp/lwt.nix
index 8357d748ce8f9..7b5673895f68d 100644
--- a/pkgs/development/ocaml-modules/cohttp/lwt.nix
+++ b/pkgs/development/ocaml-modules/cohttp/lwt.nix
@@ -1,4 +1,7 @@
-{ stdenv, buildDunePackage, cohttp, ocaml_lwt, uri, ppx_sexp_conv, logs }:
+{ stdenv, buildDunePackage
+, cohttp, ocaml_lwt, uri, logs
+, ppx_sexp_conv
+}:
 
 if !stdenv.lib.versionAtLeast cohttp.version "0.99"
 then cohttp
@@ -10,7 +13,7 @@ buildDunePackage {
 	pname = "cohttp-lwt";
 	inherit (cohttp) version src useDune2 meta;
 
-	buildInputs = [ uri ppx_sexp_conv ];
+	buildInputs = [ ppx_sexp_conv ];
 
-	propagatedBuildInputs = [ cohttp ocaml_lwt logs ];
+	propagatedBuildInputs = [ cohttp ocaml_lwt logs uri ];
 }
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 1dffe6a00b4a2..ae8159dcde110 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -139,6 +139,10 @@ let
 
     cohttp-lwt-unix = callPackage ../development/ocaml-modules/cohttp/lwt-unix.nix { };
 
+    cohttp-lwt-unix-nossl = callPackage ../development/ocaml-modules/cohttp/lwt-unix-nossl.nix { };
+
+    cohttp-lwt-unix-ssl = callPackage ../development/ocaml-modules/cohttp/lwt-unix-ssl.nix { };
+
     conduit = callPackage ../development/ocaml-modules/conduit { };
 
     conduit-async = callPackage ../development/ocaml-modules/conduit/async.nix { };