How can i distribute a list of allowed CAs in a local network?

I have a network with different OSs (Windows, macOS, iOS, Linux) and browsers. I would like to centrally manage the list of trusted Certificate Authorities on all clients/browsers. And I'd like to avoid having to manage the list CA manually on each client. Is there any OS-agnostic way to distribute the list of valid CAs to the clients, either through service discovery (have a service that announces "Hey, get your CA list here") or by a OS setting that triggers the clients to pull the list? Windows Active Directory Certificate Services seems to do this, but I'd rather use an Open Source solution.