use openssl's default verify paths if none specified