diff --git a/src/kits/network/libnetapi/SecureSocket.cpp b/src/kits/network/libnetapi/SecureSocket.cpp
index 31f8115d7e..1aaf9b344e 100644
--- a/src/kits/network/libnetapi/SecureSocket.cpp
+++ b/src/kits/network/libnetapi/SecureSocket.cpp
@@ -368,10 +368,11 @@ BSecureSocket::Private::_CreateContext()
 	BPath certificateStore;
 	find_directory(B_SYSTEM_DATA_DIRECTORY, &certificateStore);
 	certificateStore.Append("ssl/CARootCertificates.pem");
-	// TODO we may want to add a non-packaged certificate directory?
-	// (would make it possible to store user-added certificate exceptions
-	// there)
-	SSL_CTX_load_verify_locations(sContext, certificateStore.Path(), NULL);
+
+	BPath userCertificateStore;
+	find_directory(B_SYSTEM_NONPACKAGED_DATA_DIRECTORY, &userCertificateStore);
+	userCertificateStore.Append("ssl/certs/");
+	SSL_CTX_load_verify_locations(sContext, certificateStore.Path(), userCertificateStore.Path());
 	SSL_CTX_set_verify(sContext, SSL_VERIFY_PEER, VerifyCallback);
 
 	// OpenSSL 1.0.2 and later: use the alternate "trusted first" algorithm to