Does Ballerina Runtime Abstract TLS Certificate Validation Details?

Ballerina Network Behavior

The goal is to confirm how the Ballerina runtime handles certificate validation during external network operations.

Constraints

The uncertainty lies in whether the language provides fine-grained control over TLS validation parameters, or if it relies entirely on the underlying environment's defaults.

What specific runtime mechanisms govern certificate trust store usage? Does the standard library expose configuration points for custom CA validation? When does the runtime surface a certificate validation failure versus a generic network error?