Delegate default CA selection to HTTPClient

ChangeLog

@@ -1,3 +1,14 @@
+== Unreleased
+
+* Breaking: Remove the bundled CA certificates and delegate default CA selection
+  to HTTPClient. Regular API requests can trust a different set of issuers after
+  upgrading; review custom endpoints and TLS inspection proxies.
+
+* Apply explicit CA files and the verify option to bulk load requests as well as
+  regular API requests. Updating ssl_ca_file closes existing bulk load
+  connections; setting it to nil restores HTTPClient's default CA selection
+  unless a verify CA file is configured.
+
 == 2026-09-10 version 3.0.1
 
 * Drop column name validation for name "v" (#156)

README.md

@@ -59,6 +59,9 @@ E.g.
 
 ### SSL
 
+td-client does not bundle CA certificates and uses HTTPClient's default TLS
+trust configuration. Use `:verify` or `API#ssl_ca_file=` to supply a CA file.
+
 The `:ssl` key specifies whether SSL communication ought to be used when
 communicating with the default or custom endpoint.
 
@@ -77,7 +80,7 @@ E.g.
     # You can disable verification
     opts.merge({:endpoint => "https://api.treasuredata.com", :verify => false})
 
-    # You can use your own certificate
+    # You can supply a CA file
     opts.merge({:endpoint => "https://api.treasuredata.com", :verify => "/path/to/cert"})
 
 ### Proxy