mirror of
https://github.com/moparisthebest/curl
synced 2024-12-22 08:08:50 -05:00
65 lines
3.0 KiB
Plaintext
65 lines
3.0 KiB
Plaintext
Peer SSL Certificate Verification
|
|
=================================
|
|
|
|
libcurl performs peer SSL certificate verification by default. This is done by
|
|
installing a default CA cert bundle on 'make install' (or similar), that CA
|
|
bundle package is used by default on operations against SSL servers.
|
|
|
|
If you communicate with HTTPS or FTPS servers using certificates that are
|
|
signed by CAs present in the bundle, you can be sure that the remote server
|
|
really is the one it claims to be.
|
|
|
|
If the remote server uses a self-signed certificate, if you don't install
|
|
curl's CA cert bundle, if the server uses a certificate signed by a CA that
|
|
isn't included in the bundle or if the remote host is an impostor
|
|
impersonating your favorite site, and you want to transfer files from this
|
|
server, do one of the following:
|
|
|
|
1. Tell libcurl to *not* verify the peer. With libcurl you disable with with
|
|
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, FALSE);
|
|
|
|
With the curl command line tool, you disable this with -k/--insecure.
|
|
|
|
2. Get a CA certificate that can verify the remote server and use the proper
|
|
option to point out this CA cert for verification when connecting. For
|
|
libcurl hackers: curl_easy_setopt(curl, CURLOPT_CAPATH, capath);
|
|
|
|
With the curl command line tool: --cacert [file]
|
|
|
|
3. Add the CA cert for your server to the existing default CA cert bundle.
|
|
The default path of the CA bundle installed with the curl package is:
|
|
/usr/local/share/curl/curl-ca-bundle.crt, which can be changed by running
|
|
configure with the --with-ca-bundle option pointing out the path of your
|
|
choice.
|
|
|
|
If you're using the curl command line tool, you can specify your own CA
|
|
cert path by setting the environment variable CURL_CA_BUNDLE to the path
|
|
of your choice.
|
|
|
|
If you're using the curl command line tool on Windows, curl will search
|
|
for a CA cert file named "curl-ca-bundle.crt" in these directories and in
|
|
this order:
|
|
1. application's directory
|
|
2. current working directory
|
|
3. Windows System directory (e.g. C:\windows\system32)
|
|
4. Windows Directory (e.g. C:\windows)
|
|
5. all directories along %PATH%
|
|
|
|
4. Get a better/different/newer CA cert bundle! One option is to extract the
|
|
one a recent Mozilla browser uses, by following the instruction found
|
|
here:
|
|
|
|
http://curl.haxx.se/docs/caextract.html
|
|
|
|
Neglecting to use one of the above methods when dealing with a server using a
|
|
certificate that isn't signed by one of the certificates in the installed CA
|
|
cert bundle, will cause SSL to report an error ("certificate verify failed")
|
|
during the handshake and SSL will then refuse further communication with that
|
|
server.
|
|
|
|
This procedure has been deemed The Right Thing even though it adds this extra
|
|
trouble for some users, since it adds security to a majority of the SSL
|
|
connections that previously weren't really secure. It turned out many people
|
|
were using previous versions of curl/libcurl without realizing the need for
|
|
the CA cert options to get truly secure SSL connections.
|