This is my suggestion on how to add this feature. We could maybe extend this to mbedTLS and wolfSSL, but I was not sure it is worth it. OpenSSL(-like)+GnuTLS should be enough for the start.

The specific behaviour I designed for is:

# uses Apple SecTrust
> curl https://example.com

# uses *only* certs from file.pem
> curl --cacert file.pem https://example.com

# uses *both* certs from file.pem and SecTrust
> curl --ca-native --cacert file.pem https://example.com

This would also happen for a libcurl application. SecTrust would only be used when the applications does not configure any ca file/path/blob. What is currently not possible is:

# still uses Apple SecTrust
> curl --no-ca-native https://example.com

because I could not think of a way to decide if CURLOPT_SSL_OPTIONS flags did just omit CURLSSLOPT_NATIVE_CA because it did not matter before or if it was intentionally left out.

# still uses Apple SecTrust
> curl --no-ca-native https://example.com

because I could not think of a way to decide if CURLOPT_SSL_OPTIONS flags did just omit CURLSSLOPT_NATIVE_CA because it did not matter before or if it was intentionally left out.

That's right it only disables the option which disables passing the flag.

I don't know enough Apple to formally review this so I'm going to have to punt. I did take a look at it and left some comments though.

Hm, this gets some new CI failures we need to check first

Good catch, @vszakats . I need to inspect the DoH code on how it tries to set ca-bundle/-path/native from the initiating transfer.

Update: but when you explicity specify a CA-Bundle, as command line options or via env var, the native CA is turned off. You need to add --ca-native to include it.