Product CA trust store for HttpClient.tls_database, set by ensure from ca_pem_path or the trust_pem file under dir. Null when neither exists (system trust), matching HttpClient.tls_database.