I'm looking into an issue where .NET fails to trust an HTTPS certificate in a Kubernetes cluster.

The root cause is the environment mounts additional certificates and sets SSL_CERT_DIR to a colon separated list of paths, while .NET expects it to contain only a single path.

OpenSSL documents it to be a list of paths. From X509_get_default_cert_dir_env:

The X509_get_default_cert_dir() function returns a default delimeter-separated list of paths to a directories containing trusted CA certificates named in the hashed format.

Go also had this problem: golang/go#35325.

cc @bartonjs @vcsjones