From 14a3f4cd54b9e2fb0c191ec94c7e9d67a035d556 Mon Sep 17 00:00:00 2001 From: Gunter Knauf Date: Mon, 21 Sep 2009 23:00:12 +0000 Subject: [PATCH] added section for libcurl builds with NSS SSL support. --- docs/SSLCERTS | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/docs/SSLCERTS b/docs/SSLCERTS index a8ea9194b..2ace720c2 100644 --- a/docs/SSLCERTS +++ b/docs/SSLCERTS @@ -89,3 +89,28 @@ certificate that isn't signed by one of the certificates in the installed CA cert bundle, will cause SSL to report an error ("certificate verify failed") during the handshake and SSL will then refuse further communication with that server. + + Peer SSL Certificate Verification with NSS + ========================================== + +If libcurl is build with NSS support then depending on the OS distribution it +is probably required to take some additional steps to use the system-wide CA +cert db. RedHat ships with an additional module libnsspem.so which enables NSS +to read the OpenSSL PEM CA bundle. With OpenSuSE this lib is missing, and NSS +can only work with its own internal formats. Also NSS got a new database +format: +https://wiki.mozilla.org/NSS_Shared_DB +Starting with version 7.19.7 libcurl will check for the NSS version it runs, +and add automatically the 'sql:' prefix to the certdb directory (either the +hardcoded default /etc/pki/nssdb or the directory configured with SSL_DIR +environment variable) if a version 3.12.0 or later is detected. +To check which certdb format your distribution provides examine the default +certdb location /etc/pki/nssdb; the new certdb format can be identified by +the filenames cert9.db, key4.db, pkcs11.txt; filenames of older versions are +cert8.db, key3.db, modsec.db. +Usually these cert databases are empty; but NSS also has built-in CAs which are +provided through a shared library libnssckbi.so; if you want to use these +built-in CAs then create a symlink to libnssckbi.so in /etc/pki/nssdb: +ln -s /usr/lib[64]/libnssckbi.so /etc/pki/nssdb/libnssckbi.so + +