The thing is Apple used to do this correctly. Back when they still shipped OpenSSL (albeit some ancient version), they had actually patched OpenSSL to do cert validation against the native keychain and only ever had Keychain as the source of truth. You can see this in https://github.com/apple-oss-distributions/OpenSSL098/blob/O...
replyAnd curl was patched to use the native TLS implementation (SecureTransport) which obviously used Keychain as well.
For some reason when they switched to LibreSSL everywhere they decided to ship their own copy? I don't know what they were thinking.
It's also an indictment of Apple's relationship to open source software. Never mind contributing back to upstream, they haven't even made the change in their own fork to support their own keychain.
replyAlso certifi in every Python venv, keystores in every single container, nested keystores within that, it’s certificate matryoshkas all the way down!
reply> keystores in every single container, nested keystores within that
replyAt least for that, in $OLDJOB I went and created a new keystore.jks myself to account for an internal CA, so my successors can just update that file, restart the containers and that's it...