That code has existed since the API inception: https://github.com/facebook/osquery/commit/2a1f496cc5bfdf36776569c566b4453c31cb5e99 I think the issue is deploying a version built on 10.11 using a brew-provided statically linked OpenSSL which does not have the OS X SecureTransport shim to search for certs in keychain.