aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--src/main.c27
1 files changed, 18 insertions, 9 deletions
diff --git a/src/main.c b/src/main.c
index 15bb38c65..f472fbdda 100644
--- a/src/main.c
+++ b/src/main.c
@@ -359,7 +359,7 @@ static void help(void)
" --key-type <type> Specifies private key file type (DER/PEM/ENG) (HTTPS)\n"
" --pass <pass> Specifies passphrase for the private key (HTTPS)");
puts(" --engine <eng> Specifies the crypto engine to use (HTTPS)\n"
- " --cacert <file> CA certifciate to verify peer against (SSL)\n"
+ " --cacert <file> CA certificate to verify peer against (SSL)\n"
" --capath <directory> CA directory (made using c_rehash) to verify\n"
" peer against (SSL)\n"
" --ciphers <list> What SSL ciphers to use (SSL)\n"
@@ -2969,15 +2969,24 @@ operate(struct Configurable *config, int argc, char *argv[])
if((res!=CURLE_OK) && config->showerror) {
if(CURLE_SSL_CACERT == res) {
fprintf(config->errors, "curl: (%d) %s\n\n", res, errorbuffer);
-#define CURL_CA_CERT_ERRORMSG \
+#define CURL_CA_CERT_ERRORMSG1 \
"More details here: http://curl.haxx.se/docs/sslcerts.html\n\n" \
-"curl does peer SSL certificate verification by default. If you\n" \
-"communicate with HTTPS servers using certificates that are signed by CAs\n" \
-"present in the bundle, you will get truly secure SSL connections.\n" \
-"Since you get this error, you probably forgot to point out a working CA\n" \
-"cert for your server, or you forgot to use the -k (or --insecure) option.\n"
-
- fprintf(config->errors, "%s", CURL_CA_CERT_ERRORMSG);
+"curl performs SSL certificate verification by default, using a \"bundle\"\n" \
+" of Certificate Authority (CA) public keys (CA certs). The default\n" \
+" bundle is named curl-ca-bundle.crt; you can specify an alternate file\n" \
+" using the --cacert option.\n"
+
+#define CURL_CA_CERT_ERRORMSG2 \
+"If this HTTPS server uses a certificate signed by a CA represented in\n" \
+" the bundle, the certificate verification probably failed due to a\n" \
+" problem with the certificate (it might be expired, or the name might\n" \
+" not match the domain name in the URL).\n" \
+"If you'd like to turn off curl's verification of the certificate, use\n" \
+" the -k (or --insecure) option.\n"
+
+ fprintf(config->errors, "%s%s",
+ CURL_CA_CERT_ERRORMSG1,
+ CURL_CA_CERT_ERRORMSG2 );
}
else
fprintf(config->errors, "curl: (%d) %s\n", res, errorbuffer);