From 5627cf71676eb4b5b4740d41a2c2ad75300b878c Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Thu, 23 Jan 2003 06:15:26 +0000 Subject: mention what kind of error you may get if this is not followed --- SSLCERTS | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/SSLCERTS b/SSLCERTS index 6265f7274..d4a3b57b4 100644 --- a/SSLCERTS +++ b/SSLCERTS @@ -26,10 +26,14 @@ included in the bundle, then you need to do one of the following: With the curl command tool: --cacert [file] -This upgrade procedure has been deemed The Right Thing even though it adds -this extra trouble for some users, since it adds security to a majority of the -SSL connections that previously weren't really secure. - -It turned out many people were using previous versions of curl/libcurl without -realizing the need for the CA cert options to get truly secure SSL -connections. +Neglecting to use one of the above menthods when dealing with a server using a +certficate that isn't signed by one of the certficates in the installed CA +cert bundle, will cause SSL to report an error ("certificate verify failed") +during the handshake and SSL will then refuse further communication with that +server. + +This procedure has been deemed The Right Thing even though it adds this extra +trouble for some users, since it adds security to a majority of the SSL +connections that previously weren't really secure. It turned out many people +were using previous versions of curl/libcurl without realizing the need for +the CA cert options to get truly secure SSL connections. -- cgit v1.2.3