SSLCERTS


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

                      Peer SSL Certificate Verification
                      =================================

Starting in 7.10, libcurl performs peer SSL certificate verification by
default. This is done by installing a default CA cert bundle on 'make install'
(or similar), that CA bundle package is used by default on operations against
SSL servers.

Alas, if you communicate with HTTPS servers using certificates that are signed
by CAs present in the bundle, you will not notice any changed behavior and you
will seamlessly get a higher security level on your SSL connections since can
be sure that the remote server really is the one it claims to be.

If the remote server uses a self-signed certificate, or if you don't install
curl's CA cert bundle or if it uses a certificate signed by a CA that isn't
included in the bundle, then you need to do one of the following:

 1. Tell libcurl to *not* verify the peer. With libcurl you disable with with
    curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, FALSE);

    With the curl command tool, you disable this with -k/--insecure.

 2. Get a CA certificate that can verify the remote server and use the proper
    option to point out this CA cert for verification when connecting. For
    libcurl hackers: curl_easy_setopt(curl, CURLOPT_CAPATH, capath);

    With the curl command tool: --cacert [file]

This upgrade procedure has been deemed The Right Thing even though it adds
this extra trouble for some users, since it adds security to a majority of the
SSL connections that previously weren't really secure.

It turned out many people were using previous versions of curl/libcurl without
realizing the need for the CA cert options to get truly secure SSL
connections.