Dear Maintainer,


Having some "enterprise" private CA configured with ca-certificates it takes me
some research to understand that by default testssl.sh do not look at system
certificates.

To be able to validate internal chains, I created the following symlink:
/etc/testssl/System.pem ⇒ /etc/ssl/certs/ca-certificates.crt

Testing an internal server, I can now see this output for chain validation:
 Trust (hostname)             Ok via SAN and CN (same w/o SNI)
 Chain of trust               NOT ok: Apple (chain incomplete) Java (chain
incomplete) Linux (chain incomplete) Microsoft (chain incomplete) Mozilla
(chain incomplete)
                              OK: System

Also, the other anchors are managed upstream and can be outdated or out of sync
if updated, especialy on stable so it can be kind to view if a cURL command
will be able to correctly validate the certificate chain or not on this system.

So it should be interresting if a similar link was done directly by the package
(maybe with a debconf question if someone want to keep upstream default).

Regards,