--- security/py-certifi/Makefile	(revision 476573)
+++ security/py-certifi/Makefile	(working copy)
@@ -12,8 +12,18 @@ 
 
 LICENSE=	MPL20
 
+OPTIONS_DEFINE=	CA_ROOT_NSS
+CA_ROOT_NSS_DESC=	Use CA bundle from ca_root_nss
+
+CA_ROOT_NSS_RUN_DEPENDS=	ca_root_nss>0:security/ca_root_nss
+CA_ROOT_NSS_EXTRA_PATCHES=	${PATCHDIR}/extra-patch-ca_root_nss
+
 NO_ARCH=	yes
 USES=		python
 USE_PYTHON=	autoplist concurrent distutils
 
+post-patch-CA_ROOT_NSS-on:
+	@${RM} ${WRKSRC}/certifi/cacert.pem
+	@${REINPLACE_CMD} -e 's|%%PREFIX%%|${PREFIX}|' ${WRKSRC}/certifi/core.py
+
 .include <bsd.port.mk>
--- security/py-certifi/files/extra-patch-ca_root_nss	(nonexistent)
+++ security/py-certifi/files/extra-patch-ca_root_nss	(working copy)
@@ -0,0 +1,28 @@ 
+--- MANIFEST.in.orig	2018-01-18 20:27:24 UTC
++++ MANIFEST.in
+@@ -1 +1 @@
+-include MANIFEST.in README.rst LICENSE certifi/cacert.pem
++include MANIFEST.in README.rst LICENSE
+--- certifi/core.py.orig	2018-08-07 10:22:00 UTC
++++ certifi/core.py
+@@ -19,9 +19,7 @@ class DeprecatedBundleWarning(Deprecatio
+ 
+ 
+ def where():
+-    f = os.path.dirname(__file__)
+-
+-    return os.path.join(f, 'cacert.pem')
++    return '%%PREFIX%%/etc/ssl/cert.pem'
+ 
+ 
+ def old_where():
+--- setup.py.orig	2018-01-18 20:27:24 UTC
++++ setup.py
+@@ -44,7 +44,6 @@ setup(
+         'certifi',
+     ],
+     package_dir={'certifi': 'certifi'},
+-    package_data={'certifi': ['*.pem']},
+     # data_files=[('certifi', ['certifi/cacert.pem'])],
+     include_package_data=True,
+     zip_safe=False,