@jdive: we used to try to link OpenSSL as provided by the OS, since there was a lot of invariants on version/cipher support we started statically compiling (and I'm aware of what burden this requires for our dev team) one of the downsides is now we do not provide default root bundles for the client.