diff options
| -rw-r--r-- | src/main.c | 27 |
1 files changed, 18 insertions, 9 deletions
diff --git a/src/main.c b/src/main.c index 15bb38c65..f472fbdda 100644 --- a/src/main.c +++ b/src/main.c @@ -359,7 +359,7 @@ static void help(void) " --key-type <type> Specifies private key file type (DER/PEM/ENG) (HTTPS)\n" " --pass <pass> Specifies passphrase for the private key (HTTPS)"); puts(" --engine <eng> Specifies the crypto engine to use (HTTPS)\n" - " --cacert <file> CA certifciate to verify peer against (SSL)\n" + " --cacert <file> CA certificate to verify peer against (SSL)\n" " --capath <directory> CA directory (made using c_rehash) to verify\n" " peer against (SSL)\n" " --ciphers <list> What SSL ciphers to use (SSL)\n" @@ -2969,15 +2969,24 @@ operate(struct Configurable *config, int argc, char *argv[]) if((res!=CURLE_OK) && config->showerror) { if(CURLE_SSL_CACERT == res) { fprintf(config->errors, "curl: (%d) %s\n\n", res, errorbuffer); -#define CURL_CA_CERT_ERRORMSG \ +#define CURL_CA_CERT_ERRORMSG1 \ "More details here: http://curl.haxx.se/docs/sslcerts.html\n\n" \ -"curl does peer SSL certificate verification by default. If you\n" \ -"communicate with HTTPS servers using certificates that are signed by CAs\n" \ -"present in the bundle, you will get truly secure SSL connections.\n" \ -"Since you get this error, you probably forgot to point out a working CA\n" \ -"cert for your server, or you forgot to use the -k (or --insecure) option.\n" - - fprintf(config->errors, "%s", CURL_CA_CERT_ERRORMSG); +"curl performs SSL certificate verification by default, using a \"bundle\"\n" \ +" of Certificate Authority (CA) public keys (CA certs). The default\n" \ +" bundle is named curl-ca-bundle.crt; you can specify an alternate file\n" \ +" using the --cacert option.\n" + +#define CURL_CA_CERT_ERRORMSG2 \ +"If this HTTPS server uses a certificate signed by a CA represented in\n" \ +" the bundle, the certificate verification probably failed due to a\n" \ +" problem with the certificate (it might be expired, or the name might\n" \ +" not match the domain name in the URL).\n" \ +"If you'd like to turn off curl's verification of the certificate, use\n" \ +" the -k (or --insecure) option.\n" + + fprintf(config->errors, "%s%s", + CURL_CA_CERT_ERRORMSG1, + CURL_CA_CERT_ERRORMSG2 ); } else fprintf(config->errors, "curl: (%d) %s\n", res, errorbuffer); |