this is mostly a certain crypto lib's fault (maybe stdlib, let me check)
Ugh. That’s not specific to one language either. Changing CA certs or enabling OCSP is often a case of configuring the same thing in several places or multiple libraries. Identity certs doubly so. If memory serves I spent more time on that than the rest combined.