``` /usr/lib/ssl$ ls -al certs -> /etc/ssl/certs misc openssl.cnf -> /etc/ssl/openssl.cnf private -> /etc/ssl/private ``` MRI seems to inherits this from openssl currently things do follow this partially: - for private keys it looks at /usr/lib/ssl/private - cacerts it looks in $JAVA_HOME/lib/security/cacerts but not in /usr/lib/ssl/certs ubuntu does link the /usr/lib/ssl/ files to /etc/ssl so altogether jruby-openssl do use the openssl directories and just fall back on $JAVA_HOME/lib/security/cacerts if there is a not other cacerts.