def get_path(temp_dir=None, cache_length=<NUM_LIT>, cert_callback=None):
ca_path, temp = _ca_path(temp_dir)<EOL>if temp and _cached_path_needs_update(ca_path, cache_length):<EOL><INDENT>empty_set = set()<EOL>any_purpose = '<STR_LIT>'<EOL>apple_ssl = '<STR_LIT>'<EOL>win_server_auth = '<STR_LIT>'<EOL>with path_lock:<EOL><INDENT>if _cached_path_needs_update(ca_path, cache_length):<EOL><INDENT>with open(ca_path, '<STR_LIT:wb>') as f:<EOL><INDENT>for cert, trust_oids, reject_oids in extract_from_system(cert_callback, True):<EOL><INDENT>if sys.platform == '<STR_LIT>':<EOL><INDENT>if trust_oids != empty_set and any_purpose not in trust_oidsand apple_ssl not in trust_oids:<EOL><INDENT>if cert_callback:<EOL><INDENT>cert_callback(Certificate.load(cert), '<STR_LIT>')<EOL><DEDENT>continue<EOL><DEDENT>if reject_oids != empty_set and (apple_ssl in reject_oids<EOL>or any_purpose in reject_oids):<EOL><INDENT>if cert_callback:<EOL><INDENT>cert_callback(Certificate.load(cert), '<STR_LIT>')<EOL><DEDENT>continue<EOL><DEDENT><DEDENT>elif sys.platform == '<STR_LIT:win32>':<EOL><INDENT>if trust_oids != empty_set and any_purpose not in trust_oidsand win_server_auth not in trust_oids:<EOL><INDENT>if cert_callback:<EOL><INDENT>cert_callback(Certificate.load(cert), '<STR_LIT>')<EOL><DEDENT>continue<EOL><DEDENT>if reject_oids != empty_set and (win_server_auth in reject_oids<EOL>or any_purpose in reject_oids):<EOL><INDENT>if cert_callback:<EOL><INDENT>cert_callback(Certificate.load(cert), '<STR_LIT>')<EOL><DEDENT>continue<EOL><DEDENT><DEDENT>if cert_callback:<EOL><INDENT>cert_callback(Certificate.load(cert), None)<EOL><DEDENT>f.write(armor('<STR_LIT>', cert))<EOL><DEDENT><DEDENT><DEDENT><DEDENT><DEDENT>if not ca_path:<EOL><INDENT>raise CACertsError('<STR_LIT>')<EOL><DEDENT>return ca_path<EOL>
Get the filesystem path to a file that contains OpenSSL-compatible CA certs.

On OS X and Windows, there are extracted from the system certificate store
and cached in a file on the filesystem. This path should not be writable
by other users, otherwise they could inject CA certs into the trust list.

:param temp_dir:
    The temporary directory to cache the CA certs in on OS X and Windows.
    Needs to have secure permissions so other users can not modify the
    contents.

:param cache_length:
    The number of hours to cache the CA certs on OS X and Windows

:param cert_callback:
    A callback that is called once for each certificate in the trust store.
    It should accept two parameters: an asn1crypto.x509.Certificate object,
    and a reason. The reason will be None if the certificate is being
    exported, otherwise it will be a unicode string of the reason it won't.
    This is only called on Windows and OS X when passed to this function.

:raises:
    oscrypto.errors.CACertsError - when an error occurs exporting/locating certs

:return:
    The full filesystem path to a CA certs file