I would like to suggest to either extend ETCSYMLINK config option or to add a new option to support using security/ca_root_nss with openssl from ports. The latter looks at /usr/local/openssl/cert.pem as its default CAfile. -- Andriy Gapon