pkg/58942: The GNUTLS package doesn't use system-wide CA certs

[dpirate%metalpunks.info@localhost]

>Number:         58942
>Category:       pkg
>Synopsis:       The GNUTLS package doesn't use system-wide CA certs
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Dec 28 16:30:00 +0000 2024
>Originator:     Deposite Pirate
>Release:        10.1
>Organization:
metalpunks.info
>Environment:
NetBSD hermodr.midgard.lan 10.1 NetBSD 10.1 (GENERIC) #0: Mon Dec 16 13:08:11 UTC 2024  mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/i386/compile/GENERIC i386
>Description:
The GNUTLS package doesn't use the system-wide CA certs. 
>How-To-Repeat:
I have my own CA certs, and I tried to install my CA certs the following way:

- created the directory /etc/openssl/local
- copied my CA certs to this directory
- edited /etc/openssl/certs.conf and added "path /etc/openssl/local"
- ran "certcl rehash"
- ran "certctl list" to verify that my CA certs were listed

When starting weechat which itself uses GNUTLS for TLS, connection fails because my CA certs are unknown to it.
>Fix:
Modify the GNUTLS package to use the system-wide certs.