My apologies if this is too subjective, but I am looking for advice on best practices. We maintain a small program written in Python that runs on our customers' servers and communicates back with our servers. We are using Python's ssl module which relies on openssl to protect this communication back to our servers. This program is run on older Linux systems (think RHEL5) as well as Windows variants. (Yes, the ssl module doesn't come by default with Python 2.4, but please ignore that issue for the sake of this question.)
Our plan is to include a file with the program containing the certificate authority that issued our current SSL certificate, as well as some other authorities that we may use in the future. That way, we know that no matter what is on the customer's servers, our certificate authority will be trusted.
Is this reasonable, or does openssl provide a good enough list of certificate authorities even for old openssl versions that we should not need to worry about this ourselves? Are there any issues we should also consider with regards to providing our own certificate authority list, beyond just locking us into that list for future SSL certs?