pfSense

Any attempts to do certificate validation here should be completely optional here (as in, a separate checkbox). Way too many mailservers have self-signed certificates or certificates that don't validate in one way or the other.

The concept of an option to ignore certificate validation is completely unrelated to this issue.

I am interested in implementing a related feature that allows a "private CA" to be installed as a trusted root that is validated against when performing package updates. Appending to the ca-root-nss.crt file gets the job done, but is bad(tm) because that file belongs to an installed package. The better solution is to create a directory under /usr/local/etc/ssl called /usr/local/etc/ssl/crt and then configure OpenSSL to look there for additional certs.

I'm imagining that putting the OpenSSL environment variables that cause cURL to use that certs directory at the earliest point possible in the init process would also cause most other OpenSSL-based applications to also look for additional certs. Is this still an issue for you, Denny?

The root issue appears to be #4068.