certstore

nimony/lib/std/crypto/certstore.nim

The operating system's trusted root certificates, as a TrustStore for std/crypto/x509 and std/tls.

Target	Source
Windows	the `ROOT` system store (crypt32), plus a `cacert.pem` next
	to the executable or, failing that, on the `PATH`
POSIX	the first CA bundle file that exists, else the certificate
	directories (one certificate per file, `c_rehash` style)

SSL_CERT_FILE (a PEM bundle) and SSL_CERT_DIR (a directory of PEM files) replace those defaults on every platform, as they do for OpenSSL.

On Windows the ROOT store holds only what has been needed so far: Windows fetches further Microsoft-trusted roots when its own chain engine asks for them. So verifyServerChain, which std/tls uses, lets that engine (CertGetCertificateChain) judge a chain against the system store rather than the roots enumerated here.

proc verifyServerChain(store: TrustStore; chain: openArray[Certificate]; host: string; now: int64): CertError
x509.verifyChain, except that on Windows a system store lets the OS's chain engine judge: it knows roots Windows has not yet downloaded, fetches intermediates a server forgot, and honours the Disallowed store. A chain Windows only fails for want of a root still gets checked against store's own roots, which is where a cacert.pem ends up.
Building the chain can go to the network (AIA, root updates), so on Windows this may block for a while.
proc loadTrustStore(certFile: string; certDir: string): TrustStore
The roots of a PEM bundle certFile and of the PEM files in certDir (a PATH-style list of directories); either may be empty. What SSL_CERT_FILE and SSL_CERT_DIR select. Each certificate is kept once.
proc loadSystemTrustStore(): TrustStore
The operating system's trusted roots; see the module documentation for where they come from. Empty if none could be found, in which case every chain fails to verify — never the other way round.