From c5357b7b992ac6bda05a605815f43a13c78eca17 Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Thu, 16 Mar 2017 23:00:24 +0100 Subject: [PATCH] SSLCERTS.md: mention HTTPS proxies and their separate options --- docs/SSLCERTS.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/docs/SSLCERTS.md b/docs/SSLCERTS.md index 7755609c4..3fcd345b0 100644 --- a/docs/SSLCERTS.md +++ b/docs/SSLCERTS.md @@ -161,3 +161,13 @@ disabled. Secure Transport on iOS will run OCSP checks on certificates unless peer verification is disabled. Secure Transport on OS X will run either OCSP or CRL checks on certificates if those features are enabled, and this behavior can be adjusted in the preferences of Keychain Access. + +HTTPS proxy +----------- + +Since version 7.52.0, curl can do HTTPS to the proxy separately from the +connection to the server. This TLS connection is handled separately from the +server connection so instead of `--insecure` and `--cacert` to control the +certificate verification, you use `--proxy-insecure` and `--proxy-cacert`. +With these options, you make sure that the TLS connection and the trust of the +proxy can be kept totally separate from the TLS connection to the server.