Comment by dualvariable

Historically, stuff like openssl and cli command tools used flat files like /etc/ssl/certs.pem.

Browsers came along and they wanted to maintain their own cert store because operating system flat files were often out of date.

Operating systems grew their own stores because they wanted some kind of registry that was more integrated with the rest of their ecosystem.

Nobody coordinated. CLI tools and unix libraries don't care about browsers or O/S registries, operating systems have requirements so that they can't use the flat files, everyone screams about stuff like systemd turning unix into windows.

And it will continue to proliferate. System management tools often ship their own certs since the O/S certs can be out of date and untrustworthy and may not be able to talk to AWS before you bootstrap the management tool and update the system certs because people still run ancient shit like RHEL5. This is more or less the same reason browsers ship their own as well. I've made the decision to ship an embedded cert store in a product before, and nothing has fundamentally changed that would cause me to rethink that decision (even though for people who have an up-to-date O/S it is strictly additional cost that they now have to track a cert store in another product--but you have to build for the lowest common denominator).