moparisthebest/curl
1
0
Fork 0
mirror of https://github.com/moparisthebest/curl synced 2024-11-05 09:05:04 -05:00
Code Issues Releases Wiki Activity
5c4fe0d826
curl/docs/libcurl/opts/CURLOPT_SSLVERSION.3

109 lines
4.1 KiB
Groff
Raw Normal View History

opts: 29 more options as man pages
2014-06-17 18:29:22 -04:00
.\" **************************************************************************
.\" * _ _ ____ _
.\" * Project ___| | | | _ \| |
.\" * / __| | | | |_) | |
.\" * | (__| |_| | _ <| |___
.\" * \___|\___/|_| \_\_____|
.\" *
openssl: make the requested TLS version the *minimum* wanted The code treated the set version as the *exact* version to require in the TLS handshake, which is not what other TLS backends do and probably not what most people expect either. Reported-by: Andreas Olsson Assisted-by: Gaurav Malhotra Fixes #2691 Closes #2694
2018-06-28 17:24:21 -04:00
.\" * Copyright (C) 1998 - 2015, 2018, Daniel Stenberg, <daniel@haxx.se>, et al.
opts: 29 more options as man pages
2014-06-17 18:29:22 -04:00
.\" *
.\" * This software is licensed as described in the file COPYING, which
.\" * you should have received as part of this distribution. The terms
URLs: change all http:// URLs to https://
2016-02-02 18:19:02 -05:00
.\" * are also available at https://curl.haxx.se/docs/copyright.html.
opts: 29 more options as man pages
2014-06-17 18:29:22 -04:00
.\" *
.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
.\" * copies of the Software, and permit persons to whom the Software is
.\" * furnished to do so, under the terms of the COPYING file.
.\" *
.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
.\" * KIND, either express or implied.
.\" *
.\" **************************************************************************
.\"
.TH CURLOPT_SSLVERSION 3 "17 Jun 2014" "libcurl 7.37.0" "curl_easy_setopt options"
.SH NAME
CURLOPT_SSLVERSION \- set preferred TLS/SSL version
.SH SYNOPSIS
#include <curl/curl.h>
CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSLVERSION, long version);
.SH DESCRIPTION
openssl: make the requested TLS version the *minimum* wanted The code treated the set version as the *exact* version to require in the TLS handshake, which is not what other TLS backends do and probably not what most people expect either. Reported-by: Andreas Olsson Assisted-by: Gaurav Malhotra Fixes #2691 Closes #2694
2018-06-28 17:24:21 -04:00
Pass a long as parameter to control which version range of SSL/TLS versions to
opts: 29 more options as man pages
2014-06-17 18:29:22 -04:00
use.
openssl: make the requested TLS version the *minimum* wanted The code treated the set version as the *exact* version to require in the TLS handshake, which is not what other TLS backends do and probably not what most people expect either. Reported-by: Andreas Olsson Assisted-by: Gaurav Malhotra Fixes #2691 Closes #2694
2018-06-28 17:24:21 -04:00
The SSL and TLS versions have typically developed from the most insecure
version to be more and more secure in this order through history: SSL v2,
CURLOPT_SSLVERSION.3: fix typos and consistent spelling Use TLS vX.Y throughout the document, instead of TLS X.Y, as that was already done in all but a few cases. Also fix a few typos. Closes #3076 Reviewed-by: Marcel Raad <Marcel.Raad@teamviewer.com> Reviewed-by: Daniel Stenberg <daniel@haxx.se>
2018-10-03 04:22:10 -04:00
SSLv3, TLS v1.0, TLS v1.1, TLS v1.2 and the most recent TLS v1.3.
openssl: make the requested TLS version the *minimum* wanted The code treated the set version as the *exact* version to require in the TLS handshake, which is not what other TLS backends do and probably not what most people expect either. Reported-by: Andreas Olsson Assisted-by: Gaurav Malhotra Fixes #2691 Closes #2694
2018-06-28 17:24:21 -04:00
opts: 29 more options as man pages
2014-06-17 18:29:22 -04:00
Use one of the available defines for this purpose. The available options are:
.RS
.IP CURL_SSLVERSION_DEFAULT
CURLOPT_SSLVERSION.3: fix typos and consistent spelling Use TLS vX.Y throughout the document, instead of TLS X.Y, as that was already done in all but a few cases. Also fix a few typos. Closes #3076 Reviewed-by: Marcel Raad <Marcel.Raad@teamviewer.com> Reviewed-by: Daniel Stenberg <daniel@haxx.se>
2018-10-03 04:22:10 -04:00
The default acceptable version range. The minimum acceptable version is by
default TLS v1.0 since 7.39.0 (unless the TLS library has a stricter rule).
opts: 29 more options as man pages
2014-06-17 18:29:22 -04:00
.IP CURL_SSLVERSION_TLSv1
openssl: make the requested TLS version the *minimum* wanted The code treated the set version as the *exact* version to require in the TLS handshake, which is not what other TLS backends do and probably not what most people expect either. Reported-by: Andreas Olsson Assisted-by: Gaurav Malhotra Fixes #2691 Closes #2694
2018-06-28 17:24:21 -04:00
TLS v1.0 or later
opts: 29 more options as man pages
2014-06-17 18:29:22 -04:00
.IP CURL_SSLVERSION_SSLv2
openssl: make the requested TLS version the *minimum* wanted The code treated the set version as the *exact* version to require in the TLS handshake, which is not what other TLS backends do and probably not what most people expect either. Reported-by: Andreas Olsson Assisted-by: Gaurav Malhotra Fixes #2691 Closes #2694
2018-06-28 17:24:21 -04:00
SSL v2 (but not SSLv3)
opts: 29 more options as man pages
2014-06-17 18:29:22 -04:00
.IP CURL_SSLVERSION_SSLv3
openssl: make the requested TLS version the *minimum* wanted The code treated the set version as the *exact* version to require in the TLS handshake, which is not what other TLS backends do and probably not what most people expect either. Reported-by: Andreas Olsson Assisted-by: Gaurav Malhotra Fixes #2691 Closes #2694
2018-06-28 17:24:21 -04:00
SSL v3 (but not SSLv2)
opts: 29 more options as man pages
2014-06-17 18:29:22 -04:00
.IP CURL_SSLVERSION_TLSv1_0
openssl: make the requested TLS version the *minimum* wanted The code treated the set version as the *exact* version to require in the TLS handshake, which is not what other TLS backends do and probably not what most people expect either. Reported-by: Andreas Olsson Assisted-by: Gaurav Malhotra Fixes #2691 Closes #2694
2018-06-28 17:24:21 -04:00
TLS v1.0 or later (Added in 7.34.0)
opts: 29 more options as man pages
2014-06-17 18:29:22 -04:00
.IP CURL_SSLVERSION_TLSv1_1
openssl: make the requested TLS version the *minimum* wanted The code treated the set version as the *exact* version to require in the TLS handshake, which is not what other TLS backends do and probably not what most people expect either. Reported-by: Andreas Olsson Assisted-by: Gaurav Malhotra Fixes #2691 Closes #2694
2018-06-28 17:24:21 -04:00
TLS v1.1 or later (Added in 7.34.0)
opts: 29 more options as man pages
2014-06-17 18:29:22 -04:00
.IP CURL_SSLVERSION_TLSv1_2
openssl: make the requested TLS version the *minimum* wanted The code treated the set version as the *exact* version to require in the TLS handshake, which is not what other TLS backends do and probably not what most people expect either. Reported-by: Andreas Olsson Assisted-by: Gaurav Malhotra Fixes #2691 Closes #2694
2018-06-28 17:24:21 -04:00
TLS v1.2 or later (Added in 7.34.0)
vtls: support TLS 1.3 via CURL_SSLVERSION_TLSv1_3 Fully implemented with the NSS backend only for now. Reviewed-by: Ray Satiro
2016-10-27 08:57:11 -04:00
.IP CURL_SSLVERSION_TLSv1_3
openssl: make the requested TLS version the *minimum* wanted The code treated the set version as the *exact* version to require in the TLS handshake, which is not what other TLS backends do and probably not what most people expect either. Reported-by: Andreas Olsson Assisted-by: Gaurav Malhotra Fixes #2691 Closes #2694
2018-06-28 17:24:21 -04:00
TLS v1.3 or later (Added in 7.52.0)
setopt: fix SSLVERSION to allow CURL_SSLVERSION_MAX_ values Broken since f121575 (precedes 7.56.1). Bug: https://github.com/curl/curl/issues/2225 Reported-by: cmfrolick@users.noreply.github.com Closes https://github.com/curl/curl/pull/2227
2018-01-10 03:14:15 -05:00
.RE
openssl: make the requested TLS version the *minimum* wanted The code treated the set version as the *exact* version to require in the TLS handshake, which is not what other TLS backends do and probably not what most people expect either. Reported-by: Andreas Olsson Assisted-by: Gaurav Malhotra Fixes #2691 Closes #2694
2018-06-28 17:24:21 -04:00
setopt: fix SSLVERSION to allow CURL_SSLVERSION_MAX_ values Broken since f121575 (precedes 7.56.1). Bug: https://github.com/curl/curl/issues/2225 Reported-by: cmfrolick@users.noreply.github.com Closes https://github.com/curl/curl/pull/2227
2018-01-10 03:14:15 -05:00
The maximum TLS version can be set by using \fIone\fP of the
CURL_SSLVERSION_MAX_ macros below. It is also possible to OR \fIone\fP of the
CURL_SSLVERSION_ macros with \fIone\fP of the CURL_SSLVERSION_MAX_ macros.
axtls: removed As has been outlined in the DEPRECATE.md document, the axTLS code has been disabled for 6 months and is hereby removed. Use a better supported TLS library! Assisted-by: Daniel Gustafsson Closes #3194
2018-10-30 05:00:00 -04:00
The MAX macros are not supported for WolfSSL.
setopt: fix SSLVERSION to allow CURL_SSLVERSION_MAX_ values Broken since f121575 (precedes 7.56.1). Bug: https://github.com/curl/curl/issues/2225 Reported-by: cmfrolick@users.noreply.github.com Closes https://github.com/curl/curl/pull/2227
2018-01-10 03:14:15 -05:00
.RS
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
.IP CURL_SSLVERSION_MAX_DEFAULT
openssl: make the requested TLS version the *minimum* wanted The code treated the set version as the *exact* version to require in the TLS handshake, which is not what other TLS backends do and probably not what most people expect either. Reported-by: Andreas Olsson Assisted-by: Gaurav Malhotra Fixes #2691 Closes #2694
2018-06-28 17:24:21 -04:00
The flag defines the maximum supported TLS version by libcurl, or the default
value from the SSL library is used. libcurl will use a sensible default
CURLOPT_SSLVERSION.3: fix typos and consistent spelling Use TLS vX.Y throughout the document, instead of TLS X.Y, as that was already done in all but a few cases. Also fix a few typos. Closes #3076 Reviewed-by: Marcel Raad <Marcel.Raad@teamviewer.com> Reviewed-by: Daniel Stenberg <daniel@haxx.se>
2018-10-03 04:22:10 -04:00
maximum, which was TLS v1.2 up to before 7.61.0 and is TLS v1.3 since then -
openssl: make the requested TLS version the *minimum* wanted The code treated the set version as the *exact* version to require in the TLS handshake, which is not what other TLS backends do and probably not what most people expect either. Reported-by: Andreas Olsson Assisted-by: Gaurav Malhotra Fixes #2691 Closes #2694
2018-06-28 17:24:21 -04:00
assuming the TLS library support it. (Added in 7.54.0)
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
.IP CURL_SSLVERSION_MAX_TLSv1_0
openssl: make the requested TLS version the *minimum* wanted The code treated the set version as the *exact* version to require in the TLS handshake, which is not what other TLS backends do and probably not what most people expect either. Reported-by: Andreas Olsson Assisted-by: Gaurav Malhotra Fixes #2691 Closes #2694
2018-06-28 17:24:21 -04:00
The flag defines maximum supported TLS version as TLS v1.0.
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
(Added in 7.54.0)
.IP CURL_SSLVERSION_MAX_TLSv1_1
openssl: make the requested TLS version the *minimum* wanted The code treated the set version as the *exact* version to require in the TLS handshake, which is not what other TLS backends do and probably not what most people expect either. Reported-by: Andreas Olsson Assisted-by: Gaurav Malhotra Fixes #2691 Closes #2694
2018-06-28 17:24:21 -04:00
The flag defines maximum supported TLS version as TLS v1.1.
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
(Added in 7.54.0)
.IP CURL_SSLVERSION_MAX_TLSv1_2
openssl: make the requested TLS version the *minimum* wanted The code treated the set version as the *exact* version to require in the TLS handshake, which is not what other TLS backends do and probably not what most people expect either. Reported-by: Andreas Olsson Assisted-by: Gaurav Malhotra Fixes #2691 Closes #2694
2018-06-28 17:24:21 -04:00
The flag defines maximum supported TLS version as TLS v1.2.
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
(Added in 7.54.0)
.IP CURL_SSLVERSION_MAX_TLSv1_3
openssl: make the requested TLS version the *minimum* wanted The code treated the set version as the *exact* version to require in the TLS handshake, which is not what other TLS backends do and probably not what most people expect either. Reported-by: Andreas Olsson Assisted-by: Gaurav Malhotra Fixes #2691 Closes #2694
2018-06-28 17:24:21 -04:00
The flag defines maximum supported TLS version as TLS v1.3.
vtls: add options to specify range of enabled TLS versions This commit introduces the CURL_SSLVERSION_MAX_* constants as well as the --tls-max option of the curl tool. Closes https://github.com/curl/curl/pull/1166
2016-12-13 15:10:00 -05:00
(Added in 7.54.0)
opts: 29 more options as man pages
2014-06-17 18:29:22 -04:00
.RE
.SH DEFAULT
CURL_SSLVERSION_DEFAULT
.SH PROTOCOLS
opts: Corrected TLS protocols list to include POP3S rather than POP3
2015-11-07 17:11:04 -05:00
All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
opts: 29 more options as man pages
2014-06-17 18:29:22 -04:00
.SH EXAMPLE
CURLOPT_SSLVERSION.3: provide an example
2014-10-21 05:10:03 -04:00
.nf
opts: provide more and updated examples
2014-10-21 07:40:38 -04:00
CURL *curl = curl_easy_init();
CURLOPT_SSLVERSION.3: provide an example
2014-10-21 05:10:03 -04:00
if(curl) {
curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
setopt: fix SSLVERSION to allow CURL_SSLVERSION_MAX_ values Broken since f121575 (precedes 7.56.1). Bug: https://github.com/curl/curl/issues/2225 Reported-by: cmfrolick@users.noreply.github.com Closes https://github.com/curl/curl/pull/2227
2018-01-10 03:14:15 -05:00
/* ask libcurl to use TLS version 1.0 or later */
curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1);
CURLOPT_SSLVERSION.3: provide an example
2014-10-21 05:10:03 -04:00
/* Perform the request */
curl_easy_perform(curl);
}
.fi
opts: 29 more options as man pages
2014-06-17 18:29:22 -04:00
.SH AVAILABILITY
CURLOPT_SSLVERSION.3: provide an example
2014-10-21 05:10:03 -04:00
SSLv2 is disabled by default since 7.18.1. Other SSL versions availability may
vary depending on which backend libcurl has been built to use.
SSL: Remove SSLv3 from SSL default due to POODLE attack - Remove SSLv3 from SSL default in darwinssl, schannel, cyassl, nss, openssl effectively making the default TLS 1.x. axTLS is not affected since it supports only TLS, and gnutls is not affected since it already defaults to TLS 1.x. - Update CURLOPT_SSLVERSION doc
2014-10-24 07:41:56 -04:00
SSLv3 is disabled by default since 7.39.0.
opts: 29 more options as man pages
2014-06-17 18:29:22 -04:00
.SH RETURN VALUE
Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
.SH "SEE ALSO"
.BR CURLOPT_USE_SSL "(3), " CURLOPT_HTTP_VERSION "(3), "
docs: add "see also" links for SSL options - link TLS 1.2 and TLS 1.3 options - link proxy and non-proxy options Closes #3121
2018-10-10 07:00:34 -04:00
.BR CURLOPT_PROXY_SSLVERSION "(3), " CURLOPT_IPRESOLVE "(3) "
Reference in New Issue Copy Permalink