CURLOPT_PROXY_ISSUERCERT_BLOB(3)

1CURLOPT_PROXY_ISSUERCERT_BLOcBu(r3l)_easy_setopt optCiUoRnLsOPT_PROXY_ISSUERCERT_BLOB(3)
2
3
4

NAME

6       CURLOPT_PROXY_ISSUERCERT_BLOB  - proxy issuer SSL certificate from mem‐
7       ory blob
8

SYNOPSIS

10       #include <curl/curl.h>
11
12       CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_ISSUERCERT_BLOB,
13                                 struct curl_blob *blob);
14

DESCRIPTION

16       Pass a pointer  to  a  curl_blob  struct,  which  contains  information
17       (pointer  and  size) about a memory block with binary data of a CA cer‐
18       tificate in PEM format. If the  option  is  set,  an  additional  check
19       against  the  peer certificate is performed to verify the issuer of the
20       the HTTPS proxy is indeed the one associated with the certificate  pro‐
21       vided by the option. This additional check is useful in multi-level PKI
22       where one needs to enforce that the peer certificate is from a specific
23       branch of the tree.
24
25       This   option   should   be   used   in   combination   with  the  CUR‐
26       LOPT_PROXY_SSL_VERIFYPEER(3) option. Otherwise, the result of the check
27       is not considered as failure.
28
29       A  specific error code (CURLE_SSL_ISSUER_ERROR) is defined with the op‐
30       tion, which is returned if the setup of the SSL/TLS session has  failed
31       due   to   a  mismatch  with  the  issuer  of  peer  certificate  (CUR‐
32       LOPT_PROXY_SSL_VERIFYPEER(3) has to be set too for the check to fail).
33
34       If the blob is initialized with the flags member  of  struct  curl_blob
35       set to CURL_BLOB_COPY, the application does not have to keep the buffer
36       around after setting this.
37
38       This option is an alternative to CURLOPT_PROXY_ISSUERCERT(3) which  in‐
39       stead expects a file name as input.
40

DEFAULT

42       NULL
43

PROTOCOLS

45       All TLS-based protocols
46

EXAMPLE

48       CURL *curl = curl_easy_init();
49       if(curl) {
50         struct curl_blob blob;
51         curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
52         /* using an HTTPS proxy */
53         curl_easy_setopt(curl, CURLOPT_PROXY, "https://localhost:443");
54         blob.data = certificateData;
55         blob.len = filesize;
56         blob.flags = CURL_BLOB_COPY;
57         curl_easy_setopt(curl, CURLOPT_PROXY_ISSUERCERT_BLOB, &blob);
58         ret = curl_easy_perform(curl);
59         curl_easy_cleanup(curl);
60       }
61

AVAILABILITY

63       Added in 7.71.0. This option is supported by the OpenSSL backends.
64

RETURN VALUE

66       Returns  CURLE_OK  if  the option is supported, CURLE_UNKNOWN_OPTION if
67       not, or CURLE_OUT_OF_MEMORY if there was insufficient heap space.
68