openssl: create a cert.pem file from keychain certs

Rather than fuss with downloading unverified external certs, we can create a cert.pem file using the existing certs in the system keychains.

Alternative to #20300 and #20512.