Changes/dropingOfCertPemFile
In order to increase the performance of OpenSSL by default using directory-hash format we need to drop the /etc/pki/tls/cert.pem file to prevent it from being loaded by default. This also includes the certificate bundles in /etc/pki/tls/certs/ folder(ca-certificates.crt, ca-bundle.crt).
In order to improve the loading time of OpenSSL, a directory-hash support was added to ca-certificates. In order for OpenSSL to use the directory-hash format by default we need to stop it from trying to load /etc/pki/tls/cert.pem by deleting it. This also applies to the certificate bundles in /etc/pki/tls/certs/ folder(ca-certificates.crt, ca-bundle.crt).
Automated tools often rely on the output of openssl version -d to infer locations such as <OPENSSLDIR>/openssl.cnf as the configuration file. Changing OPENSSLDIR risks breaking these assumptions and complicating integrations.
A possible solution could be changing the directory to something like /usr/lib/openssl/ and shipping a symlink, e.g., /usr/lib/openssl/openssl.cnf -> /etc/pki/tls/openssl.cnf. However, this is less than ideal.
