This has been the behavior since SSLeay 0.8.1b, so it's probably not reasonable to change at this point. Calling free while not taking a reference is consistent with all the other set0 functions in the library. If you want one that takes a reference, probably call it SSL_CTX_set1_cert_store.

Though given that this function already was split into SSL_CTX_set1_verify_cert_store and SSL_CTX_set1_chain_cert_store which two have both set0 and set1 variants, perhaps leaving it alone and deprecating the combined one in favor of the split ones makes more sense?

I assume this was a new function, but you're right it's not. And the new functions already do the right thing it seems, so maybe I should just use those instead.