Index: src/http.c
==================================================================
--- src/http.c
+++ src/http.c
@@ -768,10 +768,11 @@
 ** a GET request where there is no PAYLOAD.
 **
 ** Options:
 **     --compress                 Use ZLIB compression on the payload
 **     --mimetype TYPE            Mimetype of the payload
+**     --no-cert-verify           Disable TLS cert verification
 **     --out FILE                 Store the reply in FILE
 **     -v                         Verbose output
 **     --xfer                     PAYLOAD in a Fossil xfer protocol message
 */
 void test_httpmsg_command(void){
@@ -783,10 +784,13 @@
 
   zMimetype = find_option("mimetype",0,1);
   zOutFile = find_option("out","o",1);
   if( find_option("verbose","v",0)!=0 ) mHttpFlags |= HTTP_VERBOSE;
   if( find_option("compress",0,0)!=0 ) mHttpFlags &= ~HTTP_NOCOMPRESS;
+  if( find_option("no-cert-verify",0,0)!=0 ){
+    ssl_disable_cert_verification();
+  }
   if( find_option("xfer",0,0)!=0 ){
     mHttpFlags |= HTTP_USE_LOGIN;
     mHttpFlags &= ~HTTP_GENERIC;
   }
   verify_all_options();

Index: src/http_ssl.c
==================================================================
--- src/http_ssl.c
+++ src/http_ssl.c
@@ -247,11 +247,11 @@
 
 /*
 ** Call this routine once before any other use of the SSL interface.
 ** This routine does initial configuration of the SSL module.
 */
-static void ssl_global_init_client(void){
+static void ssl_global_init_client(int bDebug){
   const char *identityFile;
 
   if( sslIsInit==0 ){
     const char *zFile;
     const char *zCaFile = 0;
@@ -301,10 +301,30 @@
           zCaFile = zFile;
           zCaDirectory = 0;
           break;
         }
       }
+      if( zFile ) break;
+    }
+    if( bDebug ){
+      fossil_print("case-0:  X509_get_default_cert_file_env = %s\n",
+                   X509_get_default_cert_file_env());
+      fossil_print("case-1:  X509_get_default_cert_dir_env = %s\n",
+                   X509_get_default_cert_dir_env());
+      fossil_print("case-2:  ssl-ca-location = %s\n",
+             g.repositoryOpen ? db_get("ssl-ca-location","(none)") : "(none)");
+      fossil_print("case-3:  X509_get_default_cert_file = %s\n",
+                   X509_get_default_cert_file());
+      fossil_print("case-4:  X509_get_default_cert_dir = %s\n",
+                   X509_get_default_cert_dir());
+      if( i>=5 ){
+        fossil_print("No trust store found.\n");
+      }else{
+        fossil_print("case-used    = %d\n"
+                     "zCaFile      = %s\n"
+                     "zCaDirectory = %s\n", i, zCaFile, zCaDirectory);
+      }
     }
     if( zFile==0 ){
       /* fossil_fatal("Cannot find a trust store"); */
     }else if( SSL_CTX_load_verify_locations(sslCtx, zCaFile, zCaDirectory)==0 ){
       fossil_fatal("Cannot load CA root certificates from %s", zFile);
@@ -333,15 +353,22 @@
       identityFile = g.zSSLIdentity;
     }else{
       identityFile = db_get("ssl-identity", 0);
     }
     if( identityFile!=0 && identityFile[0]!='\0' ){
+      if( bDebug ){
+        fossil_print("identifyFile = %s\n", identityFile);
+      }
       if( SSL_CTX_use_certificate_chain_file(sslCtx,identityFile)!=1
        || SSL_CTX_use_PrivateKey_file(sslCtx,identityFile,SSL_FILETYPE_PEM)!=1
       ){
         fossil_fatal("Could not load SSL identity from %s", identityFile);
       }
+    }else{
+      if( bDebug ){
+        fossil_print("No identify file found.\n");
+      }
     }
     /* Register a callback to tell the user what to do when the server asks
     ** for a cert */
     SSL_CTX_set_client_cert_cb(sslCtx, ssl_client_cert_callback);
 
@@ -359,10 +386,21 @@
     SSL_CTX_free(sslCtx);
     ssl_clear_errmsg();
     sslIsInit = 0;
   }
 }
+
+/*
+** COMMAND: test-trust-store
+**
+** Show the trust store that is used by OpenSSL. 
+*/
+void test_openssl_trust_store(void){
+  ssl_global_init_client(1);
+  ssl_global_shutdown();
+}
+
 
 /*
 ** Close the currently open client SSL connection.  If no connection is open,
 ** this routine is a no-op.
 */
@@ -446,11 +484,11 @@
 */
 int ssl_open_client(UrlData *pUrlData){
   X509 *cert;
   const char *zRemoteHost;
 
-  ssl_global_init_client();
+  ssl_global_init_client(0);
   if( pUrlData->useProxy ){
     int rc;
     char *connStr = mprintf("%s:%d", g.url.name, pUrlData->port);
     BIO *sBio = BIO_new_connect(connStr);
     free(connStr);