Comment 15 for bug 242313

It looks like very recent GnuTLS releases (>= 3.3.6) may have finally added the API needed to make this possible:

https://www.happyassassin.net/2015/01/12/a-note-about-ssltls-trusted-certificate-stores-and-platforms/

http://gnutls.org/manual/html_node/X509-certificate-API.html#index-gnutls_005fx509_005ftrust_005flist_005fadd_005ftrust_005fdir

No idea whether or not it's as simple as it looks, but I'll have a go at it some time.