Where are the root CAs stored on OS X?

I need one of the root CA certificates, as a filename, to pass to a command-line program. I could download it from DigiCert (and convert it to the required format, .crt) manually, but I figure it's easier to just use the CA that OS X must already have. It's a common certificate, and all my Linux servers already have it, for example. In the "Keychain Access" app, the correct certificate does exist, but I can't find anything that says where it lives. Do these CAs exist in the filesystem, or only in an opaque proprietary format for OS X APIs?