SSL_CTX_set_default_verify_paths allows to select the system-wide CA certificates on an SSL context, if OpenSSL was built with the right options. We could also try to expose those default paths by calling X509_get_default_cert_file() / X509_get_default_cert_dir(), but these seem even less documented (private?).