1CURLOPT_SSL_CTX_FUNCTION(3)curl_easy_setopt optionsCURLOPT_SSL_CTX_FUNCTION(3)
2
3
4

NAME

6       CURLOPT_SSL_CTX_FUNCTION - SSL context callback for OpenSSL, wolfSSL or
7       mbedTLS
8

SYNOPSIS

10       #include <curl/curl.h>
11
12       CURLcode ssl_ctx_callback(CURL *curl, void *ssl_ctx, void *userptr);
13
14       CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_CTX_FUNCTION,
15                                 ssl_ctx_callback);
16

DESCRIPTION

18       This option only works for  libcurl  powered  by  OpenSSL,  wolfSSL  or
19       mbedTLS.  If  libcurl  was built against another SSL library this func‐
20       tionality is absent.
21
22       Pass a pointer to your callback function, which should match the proto‐
23       type shown above.
24
25       This  callback function gets called by libcurl just before the initial‐
26       ization of an SSL connection after having processed all other  SSL  re‐
27       lated options to give a last chance to an application to modify the be‐
28       havior of the SSL initialization. The ssl_ctx parameter is  actually  a
29       pointer  to  the  SSL  library's  SSL_CTX for OpenSSL or wolfSSL, and a
30       pointer to mbedtls_ssl_config for mbedTLS. If an error is returned from
31       the  callback no attempt to establish a connection is made and the per‐
32       form operation will return the callback's error code. Set  the  userptr
33       argument with the CURLOPT_SSL_CTX_DATA(3) option.
34
35       This  function will get called on all new connections made to a server,
36       during the SSL negotiation. The ssl_ctx will point to a newly  initial‐
37       ized  object  each time, but note the pointer may be the same as from a
38       prior call.
39
40       To use this properly, a non-trivial amount of knowledge of your SSL li‐
41       brary  is necessary. For example, you can use this function to call li‐
42       brary-specific callbacks to add additional validation code for certifi‐
43       cates, and even to change the actual URI of an HTTPS request.
44
45       WARNING:  The  CURLOPT_SSL_CTX_FUNCTION(3) callback allows the applica‐
46       tion to reach in and modify  SSL  details  in  the  connection  without
47       libcurl  itself  knowing anything about it, which then subsequently can
48       lead to libcurl unknowingly  reusing  SSL  connections  with  different
49       properties. To remedy this you may set CURLOPT_FORBID_REUSE(3) from the
50       callback function.
51
52       WARNING: If you are using DNS-over-HTTPS (DoH)  via  CURLOPT_DOH_URL(3)
53       then  the  CTX callback will also be called for those transfers and the
54       curl handle is set to an internal handle. This behavior is  subject  to
55       change.   We recommend before performing your transfer set CURLOPT_PRI‐
56       VATE(3) on your curl handle so you can identify it in the CTX callback.
57       If  you  have  a reason to modify DoH SSL context please let us know on
58       the curl-library mailing list because we are considering removing  this
59       capability.
60

DEFAULT

62       NULL
63

PROTOCOLS

65       All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
66

EXAMPLE

68       /* OpenSSL specific */
69
70       #include <openssl/ssl.h>
71       #include <curl/curl.h>
72       #include <stdio.h>
73
74       static CURLcode sslctx_function(CURL *curl, void *sslctx, void *parm)
75       {
76         X509_STORE *store;
77         X509 *cert = NULL;
78         BIO *bio;
79         char *mypem = parm;
80         /* get a BIO */
81         bio = BIO_new_mem_buf(mypem, -1);
82         /* use it to read the PEM formatted certificate from memory into an
83          * X509 structure that SSL can use
84          */
85         PEM_read_bio_X509(bio, &cert, 0, NULL);
86         if(cert == NULL)
87           printf("PEM_read_bio_X509 failed...\n");
88
89         /* get a pointer to the X509 certificate store (which may be empty) */
90         store = SSL_CTX_get_cert_store((SSL_CTX *)sslctx);
91
92         /* add our certificate to this store */
93         if(X509_STORE_add_cert(store, cert) == 0)
94           printf("error adding certificate\n");
95
96         /* decrease reference counts */
97         X509_free(cert);
98         BIO_free(bio);
99
100         /* all set to go */
101         return CURLE_OK;
102       }
103
104       int main(void)
105       {
106         CURL * ch;
107         CURLcode rv;
108         char *mypem = /* example CA cert PEM - shortened */
109           "-----BEGIN CERTIFICATE-----\n"
110           "MIIHPTCCBSWgAwIBAgIBADANBgkqhkiG9w0BAQQFADB5MRAwDgYDVQQKEwdSb290\n"
111           "IENBMR4wHAYDVQQLExVodHRwOi8vd3d3LmNhY2VydC5vcmcxIjAgBgNVBAMTGUNB\n"
112           "IENlcnQgU2lnbmluZyBBdXRob3JpdHkxITAfBgkqhkiG9w0BCQEWEnN1cHBvcnRA\n"
113           "Y2FjZXJ0Lm9yZzAeFw0wMzAzMzAxMjI5NDlaFw0zMzAzMjkxMjI5NDlaMHkxEDAO\n"
114           "GCSNe9FINSkYQKyTYOGWhlC0elnYjyELn8+CkcY7v2vcB5G5l1YjqrZslMZIBjzk\n"
115           "zk6q5PYvCdxTby78dOs6Y5nCpqyJvKeyRKANihDjbPIky/qbn3BHLt4Ui9SyIAmW\n"
116           "omTxJBzcoTWcFbLUvFUufQb1nA5V9FrWk9p2rSVzTMVD\n"
117           "-----END CERTIFICATE-----\n";
118
119         curl_global_init(CURL_GLOBAL_ALL);
120         ch = curl_easy_init();
121
122         curl_easy_setopt(ch, CURLOPT_SSLCERTTYPE, "PEM");
123         curl_easy_setopt(ch, CURLOPT_SSL_VERIFYPEER, 1L);
124         curl_easy_setopt(ch, CURLOPT_URL, "https://www.example.com/");
125
126         /* Retrieve page using cacerts' certificate -> will succeed
127          * load the certificate by installing a function doing the necessary
128          * "modifications" to the SSL CONTEXT just before link init
129          */
130         curl_easy_setopt(ch, CURLOPT_SSL_CTX_FUNCTION, *sslctx_function);
131         curl_easy_setopt(ch, CURLOPT_SSL_CTX_DATA, mypem);
132         rv = curl_easy_perform(ch);
133         if(!rv)
134           printf("*** transfer succeeded ***\n");
135         else
136           printf("*** transfer failed ***\n");
137
138         curl_easy_cleanup(ch);
139         curl_global_cleanup();
140         return rv;
141       }
142

AVAILABILITY

144       Added  in  7.11.0  for OpenSSL, in 7.42.0 for wolfSSL and in 7.54.0 for
145       mbedTLS. Other SSL backends are not supported.
146

RETURN VALUE

148       CURLE_OK if supported; or an error such as:
149
150       CURLE_NOT_BUILT_IN - Not supported by the SSL backend
151
152       CURLE_UNKNOWN_OPTION
153

SEE ALSO

155       CURLOPT_SSL_CTX_DATA(3), CURLOPT_SSL_VERIFYPEER(3),
156
157
158
159libcurl 7.79.1                   July 26, 2021     CURLOPT_SSL_CTX_FUNCTION(3)
Impressum