Elixir :ssl certificate validation failures with custom CA bundles

When implementing secure connections using the :ssl module in Elixir, the runtime relies on the Erlang VM to validate certificates against the host operating system's CA store. In environments where certificates are managed via custom bundles or non-standard paths, the default validation behavior may fail to locate the necessary root certificates.

There is a design trade-off between relying on the system's default certificate store and explicitly defining cacertfile or cacerts options within the SSL configuration. Overriding these settings ensures consistency across different OS distributions but increases the maintenance burden for certificate rotation.

• How does the Erlang VM prioritize system-level CA stores versus explicitly provided certificate files in the :ssl options?
• What is the recommended approach for updating the CA store dynamically without requiring a full node restart?