From 55b78c5ae94852ffb942ff979e6f25aebfeedb16 Mon Sep 17 00:00:00 2001 From: moparisthebest Date: Tue, 30 Jun 2015 20:23:54 -0400 Subject: SSL: Pinned public key hash support --- docs/curl.1 | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) (limited to 'docs/curl.1') diff --git a/docs/curl.1 b/docs/curl.1 index 11b95d4ef..afd4e8c35 100644 --- a/docs/curl.1 +++ b/docs/curl.1 @@ -544,9 +544,11 @@ OpenSSL-powered curl to make SSL-connections much more efficiently than using If this option is set, the default capath value will be ignored, and if it is used several times, the last one will be used. -.IP "--pinnedpubkey " -(SSL) Tells curl to use the specified public key file to verify the peer. The -file must contain a single public key in PEM or DER format. +.IP "--pinnedpubkey " +(SSL) Tells curl to use the specified public key file (or hashes) to verify the +peer. This can be a path to a file which contains a single public key in PEM or +DER format, or any number of base64 encoded sha256 hashes preceded by +\'sha256//\' and seperated by \';\' When negotiating a TLS or SSL connection, the server sends a certificate indicating its identity. A public key is extracted from this certificate and @@ -554,7 +556,8 @@ if it does not exactly match the public key provided to this option, curl will abort the connection before sending or receiving any data. Added in 7.39.0 for OpenSSL, GnuTLS and GSKit. Added in 7.43.0 for NSS and -wolfSSL/CyaSSL. Other SSL backends not supported. +wolfSSL/CyaSSL. sha256 support added in 7.44.0 for OpenSSL, +GnuTLS, NSS and wolfSSL/CyaSSL. Other SSL backends not supported. If this option is used several times, the last one will be used. .IP "--cert-status" -- cgit v1.2.3