Why not just buildlink3 against openssl, and then you can use the names? It seems unusual to open-code the CHECK_BUILTIN. mozilla-rootcerts should depend on openssl anyway, so that these files can be removed before openssl is removed. I realize that doesn't quite make sense with manual install, but conceptually it seems closer than not depending. But this seems like progress, so I'm not objecting.
Attachment:
pgplh1KQuQzXE.pgp
Description: PGP signature