openssl: add caveat about CA certs

Closes #17882.