Thanks for the tip.
The most powerful, flexible, counterintuitive and illogical ssl implementation i’ve encountered.
providing cacerts as cacerts: [cert1, cert2] doesn’t work either, producing the same SSL WARNING: Ignoring a CA cert as it could not be... warning per line + handshake failure or reason: :closed
:public_key.pem_decode works just fine, producing parsed data. tried some other formats - no luck as well.
At this moment i gave up and just wrote wrapper which uses curl . 
Thanks everyone!
