(Sorry I hit Enter too early) In case it's compiled without P11KIT and TPM options, security/ca_root_nss is configured with: --with-default-trust-store-file=${LOCALBASE}/share/certs/ca-root-nss.crt This means not all the certificates on the system are considered, but only those provided by security/ca_root_nss (which, BTW, I heard is going away). Simply replacing the above line with: --with-default-trust-store-dir=/etc/ssl/certs makes this port use the same certificates openssl (i.e. the base system) uses. Perhaps this should be made into an option?
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=a67a3f98ec28b607845ab6a33b2d2c5504f5b137 commit a67a3f98ec28b607845ab6a33b2d2c5504f5b137 Author: Tijl Coosemans <tijl@FreeBSD.org> AuthorDate: 2022-03-24 22:49:24 +0000 Commit: Tijl Coosemans <tijl@FreeBSD.org> CommitDate: 2022-04-13 12:11:59 +0000 security/gnutls: update to 3.7.4 Switch from security/ca_root_nss to base system certificate store. Disable obsolete TPM 1.2 support. PR: 257995, 260723, 263107, 263131 Exp-run by: antoine security/gnutls/Makefile | 30 +++++++--------- security/gnutls/distinfo | 6 ++-- .../files/patch-tests_cert-tests_pkcs12.sh (new) | 14 ++++++++ security/gnutls/pkg-plist | 40 +++++++++++++++++++--- 4 files changed, 66 insertions(+), 24 deletions(-)