title: openssl/wget only working if i explicitly specify ca-directory
body: <p>If I try to use openssl or wget without explicitly passing in a ca-directory, the certifcate fails to verify. I would like to get ubuntu back to the original state of verifying normal sites like google.com easily. Is there an env variable i need to set, or a symlink i need to enable to get thhis configured properly?</p>
  
  <pre><code>chris@chris:~$ wget --ca-directory=/etc/ssl/certs https://google.com
  --2019-04-13 12:42:12--  https://google.com/
  Resolving google.com (google.com)... 172.217.4.206, 2607:f8b0:4009:807::200e
  Connecting to google.com (google.com)|172.217.4.206|:443... connected.
  HTTP request sent, awaiting response... 301 Moved Permanently
  Location: https://www.google.com/ [following]
  --2019-04-13 12:42:12--  https://www.google.com/
  Resolving www.google.com (www.google.com)... 172.217.4.36, 2607:f8b0:4009:80f::2004
  Connecting to www.google.com (www.google.com)|172.217.4.36|:443... connected.
  HTTP request sent, awaiting response... 200 OK
  Length: unspecified [text/html]
  Saving to: ‘index.html.5’
  
  index.html.5                                      [ &lt;=&gt;                                                                                             ]  11.07K  --.-KB/s    in 0.004s
  
  2019-04-13 12:42:12 (2.88 MB/s) - ‘index.html.5’ saved [11340]
  
  chris@chris:~$ wget https://google.com
  --2019-04-13 12:42:19--  https://google.com/
  Resolving google.com (google.com)... 172.217.4.206, 2607:f8b0:4009:807::200e
  Connecting to google.com (google.com)|172.217.4.206|:443... connected.
  ERROR: cannot verify google.com's certificate, issued by ‘CN=Google Internet Authority G3,O=Google Trust Services,C=US’:
    Unable to locally verify the issuer's authority.
  To connect to google.com insecurely, use `--no-check-certificate'.
  </code></pre>
  
  <p>Here is the same behavior with openssl if i do not explicitly pass in <code>-CApath</code></p>
  
  <pre><code>-----END CERTIFICATE-----
  subject=/C=US/ST=California/L=Mountain View/O=Google LLC/CN=www.google.com
  issuer=/C=US/O=Google Trust Services/CN=Google Internet Authority G3
  ---
  No client certificate CA names sent
  Peer signing digest: SHA256
  Server Temp Key: X25519, 253 bits
  ---
  SSL handshake has read 2962 bytes and written 261 bytes
  Verification error: unable to get local issuer certificate
  ---
  </code></pre>