[threeseed]

That behaviour is also a curl configuration option i.e. with-ca-fallback.

Curl definitely should be updating man pages if it is falling back to OpenSSL CAs when --cacert is specified.

Homebrew Curl on Mac also sets this flag:

https://github.com/Homebrew/homebrew-core/blob/9cccce7a6dff7...

[Retr0id]

curl (proper) doesn't do that, nor is it supposed to, that's the point

[threeseed]

This behaviour is part of curl (proper) and is set via compile time flags.

And at least according to curl's code is set by default when it is built against OpenSSL:

https://github.com/curl/curl/blob/1ccf1cd9936dfa382fe1f061b6...

[Retr0id]

It's not set by default. (and even when it is set, does it modify the behaviour of the --cacert option?)

[b112]

You mean Apple, who modified the code to work in this broken way.