aboutsummaryrefslogtreecommitdiff
path: root/docs/libcurl/opts/CURLOPT_PINNEDPUBLICKEY.3
diff options
context:
space:
mode:
Diffstat (limited to 'docs/libcurl/opts/CURLOPT_PINNEDPUBLICKEY.3')
-rw-r--r--docs/libcurl/opts/CURLOPT_PINNEDPUBLICKEY.314
1 files changed, 14 insertions, 0 deletions
diff --git a/docs/libcurl/opts/CURLOPT_PINNEDPUBLICKEY.3 b/docs/libcurl/opts/CURLOPT_PINNEDPUBLICKEY.3
index e3de9f2a8..14c44daf5 100644
--- a/docs/libcurl/opts/CURLOPT_PINNEDPUBLICKEY.3
+++ b/docs/libcurl/opts/CURLOPT_PINNEDPUBLICKEY.3
@@ -59,10 +59,24 @@ if(curl) {
If you do not have the server's public key file you can extract it from the
server's certificate.
.nf
+# retrieve the server's certificate if you don't already have it
+#
+# be sure to examine the certificate to see if it is what you expected
+#
+# Windows-specific:
+# - Use NUL instead of /dev/null.
+# - OpenSSL may wait for input instead of disconnecting. Hit enter.
+# - If you don't have sed, then just copy the certificate into a file:
+# Lines from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE-----.
+#
+openssl s_client -servername www.test.com -connect www.test.com:443 < /dev/null | sed -n "/-----BEGIN/,/-----END/p" > www.test.com.pem
+
# extract public key in pem format from certificate
openssl x509 -in www.test.com.pem -pubkey -noout > www.test.com.pubkey.pem
+
# convert public key from pem to der
openssl asn1parse -noout -inform pem -in www.test.com.pubkey.pem -out www.test.com.pubkey.der
+
# sha256 hash and base64 encode der to string for use
openssl dgst -sha256 -binary www.test.com.pubkey.der | openssl base64
.fi