CURLOPT_CAINFO(3)

1CURLOPT_CAINFO(3)                   libcurl                  CURLOPT_CAINFO(3)
2
3
4

NAME

6       CURLOPT_CAINFO - path to Certificate Authority (CA) bundle
7

SYNOPSIS

9       #include <curl/curl.h>
10
11       CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CAINFO, char *path);
12

DESCRIPTION

14       Pass  a char * to a null-terminated string naming a file holding one or
15       more certificates to verify the peer with.
16
17       If CURLOPT_SSL_VERIFYPEER(3)  is  zero  and  you  avoid  verifying  the
18       server's  certificate,  CURLOPT_CAINFO(3) need not even indicate an ac‐
19       cessible file.
20
21       This option is by default set to the system  path  where  libcurl's  CA
22       certificate  bundle  is  assumed  to be stored, as established at build
23       time.
24
25       If curl is built against the NSS SSL library, the NSS PEM PKCS#11  mod‐
26       ule  (libnsspem.so) needs to be available for this option to work prop‐
27       erly.  Starting with curl 7.55.0, if both  CURLOPT_CAINFO(3)  and  CUR‐
28       LOPT_CAPATH(3)  are  unset,  NSS-linked  libcurl  tries to load libnss‐
29       ckbi.so, which contains a more comprehensive set of  trust  information
30       than supported by nss-pem, because libnssckbi.so also includes informa‐
31       tion about distrusted certificates.
32
33       (iOS and macOS) When curl uses Secure Transport  this  option  is  sup‐
34       ported.  If  the option is not set, then curl will use the certificates
35       in the system and user Keychain to verify the peer.
36
37       (Schannel) This option is supported for Schannel in Windows 7 or  later
38       but  we  recommend  not  using it until Windows 8 since it works better
39       starting then.  If the option is not set, then curl will use  the  cer‐
40       tificates  in  the Windows' store of root certificates (the default for
41       Schannel).
42
43       The application does not have to keep the string around  after  setting
44       this option.
45
46       The default value for this can be figured out with CURLINFO_CAINFO(3).
47

DEFAULT

49       Built-in  system  specific. When curl is built with Secure Transport or
50       Schannel, this option is not set by default.
51

PROTOCOLS

53       All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
54

EXAMPLE

56       CURL *curl = curl_easy_init();
57       if(curl) {
58         curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
59         curl_easy_setopt(curl, CURLOPT_CAINFO, "/etc/certs/cabundle.pem");
60         ret = curl_easy_perform(curl);
61         curl_easy_cleanup(curl);
62       }
63

AVAILABILITY

65       For the SSL engines that do not  support  certificate  files  the  CUR‐
66       LOPT_CAINFO(3)  option  is  ignored.  Schannel support added in libcurl
67       7.60.
68

RETURN VALUE

70       Returns CURLE_OK if the option is  supported,  CURLE_UNKNOWN_OPTION  if
71       not, or CURLE_OUT_OF_MEMORY if there was insufficient heap space.
72