title: OpenSSL reasonable default for trusted CA certificates?
body: <p>Is there a way to set up an OpenSSL context (<code>SSL_CTX</code>) with a reasonable set of trusted CA certificates <em>without</em> distributing them myself? I don't want the responsibility of keeping them up to date. IMO any modern operating system should provide "get me the trusted CA certs" as a service, but I don't know if that's actually the case.</p>
  
  <p>I don't mind writing this code three times (once for Windows, once for Mac OS X, and once for Linux), but I'd prefer to cap it at that. In particular, I'd rather not try to write code that snoops around looking for what browsers are installed and trying to extract their trusted certificates. (Apparently it's <a href="http://www.imperialviolet.org/2012/01/30/mozillaroots.html" rel="noreferrer">easy to get this very wrong</a>.)</p>
  
  <p>The answer for recent versions of Linux seems to be to call <code>SSL_CTX_load_verify_locations</code> with <code>/etc/ssl/certs/ca-certificates.crt</code> (if that file exists).</p>
  
  <p>Are there simple answers for Windows and Mac OS X?</p>