romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-24 02:07:17 +03:00
Code Issues Projects Releases Packages Wiki Activity

TLS: remove support for Secure Transport and BearSSL

Browse source 
These libraries do not support TLS 1.3 and have been marked for removal
for over a year. We want to help users select a TLS dependency that is
future-proof and reliable, and not supporting TLS 1.3 in 2025 does not
infer confidence. Users who build libcurl are likely to be served better
and get something more future-proof with a TLS library that supports
1.3.

Closes #16677
This commit is contained in:
Daniel Stenberg 2025-06-09 14:07:21 +02:00
parent b761eb5add
commit 08a3e8e19a
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
89 changed files with 163 additions and 5036 deletions
Download patch file Download diff file Expand all files Collapse all files

7
docs/CIPHERS.md
View file

@ -96,8 +96,7 @@ are NULL ciphers, offering no encryption whatsoever.)
### TLS 1.2 (1.1, 1.0) cipher suites
Setting TLS 1.2 cipher suites is supported by curl with OpenSSL, LibreSSL,
BoringSSL, mbedTLS (curl 8.8.0+), wolfSSL (curl 7.53.0+),
Secure Transport (curl 7.77.0+) and BearSSL (curl 7.83.0+). Schannel does not
BoringSSL, mbedTLS (curl 8.8.0+), wolfSSL (curl 7.53.0+). Schannel does not
support setting cipher suites directly, but does support setting algorithms
(curl 7.61.0+), see Schannel notes below.
@ -201,7 +200,7 @@ ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305 \
```
Restrict TLS 1.2 ciphers to `aes128-gcm` and `chacha20`, use default TLS 1.3
ciphers (if TLS 1.3 is available). Works with OpenSSL, LibreSSL, BoringSSL,
mbedTLS, wolfSSL, Secure Transport and BearSSL.
mbedTLS and wolfSSL.
## ciphers, the GnuTLS way
@ -266,8 +265,6 @@ Restrict to only TLS 1.2 with the `CAMELLIA-128-GCM` cipher.
- [wolfSSL cipher support documentation](https://www.wolfssl.com/documentation/manuals/wolfssl/chapter04.html#cipher-support)
- [mbedTLS cipher suites reference](https://mbed-tls.readthedocs.io/projects/api/en/development/api/file/ssl__ciphersuites_8h/)
- [Schannel cipher suites documentation](https://learn.microsoft.com/en-us/windows/win32/secauthn/cipher-suites-in-schannel)
- [BearSSL supported crypto](https://www.bearssl.org/support.html)
- [Secure Transport cipher suite values](https://developer.apple.com/documentation/security/1550981-ssl_cipher_suite_values)
- [IANA cipher suites list](https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4)
- [Wikipedia cipher suite article](https://en.wikipedia.org/wiki/Cipher_suite)
- [GnuTLS Priority Strings](https://gnutls.org/manual/html_node/Priority-Strings.html)

2
docs/CURLDOWN.md
View file

@ -95,13 +95,11 @@ If the `Protocol` list contains `TLS`, then there must also be a `TLS-backend`
list, specifying `All` or a list of what TLS backends that work with this
option. The available TLS backends are:
- `BearSSL`
- `GnuTLS`
- `mbedTLS`
- `OpenSSL` (also covers BoringSSL, LibreSSL, quictls, AWS-LC and AmiSSL)
- `rustls`
- `Schannel`
- `Secure Transport`
- `wolfSSL`
- `All`: all TLS backends

13
docs/DEPRECATE.md
View file

@ -12,16 +12,9 @@ email the
as soon as possible and explain to us why this is a problem for you and
how your use case cannot be satisfied properly using a workaround.
## TLS libraries without 1.3 support
## Nothing
curl drops support for TLS libraries without TLS 1.3 capability after May
2025.
It requires that a curl build using the library should be able to negotiate
and use TLS 1.3, or else it is not good enough.
As of May 2024, the libraries that need to get fixed to remain supported after
May 2025 are: BearSSL and Secure Transport.
Nothing is currently scheduled to be removed.
## msh3 support
@ -75,3 +68,5 @@ Previous discussion and details: https://github.com/curl/curl/discussions/15972
- NTLM_WB (removed in 8.8.0)
- space-separated `NOPROXY` patterns (removed in 8.9.0)
- hyper (removed in 8.12.0)
- Secure Transport (8.15.0)
- BearSSL (8.15.0)

11
docs/FAQ
View file

@ -423,10 +423,9 @@ FAQ
backends.
curl can be built to use one of the following SSL alternatives: OpenSSL,
LibreSSL, BoringSSL, AWS-LC, GnuTLS, wolfSSL, mbedTLS, Secure Transport
(native iOS/macOS), Schannel (native Windows), BearSSL or Rustls. They all
have their pros and cons, and we try to maintain a comparison of them here:
https://curl.se/docs/ssl-compared.html
LibreSSL, BoringSSL, AWS-LC, GnuTLS, wolfSSL, mbedTLS, Schannel (native
Windows) or Rustls. They all have their pros and cons, and we try to
maintain a comparison of them here: https://curl.se/docs/ssl-compared.html
2.3 How do I upgrade curl.exe in Windows?
@ -918,8 +917,8 @@ FAQ
4.9 curl cannot authenticate to a server that requires NTLM?
NTLM support requires OpenSSL, GnuTLS, mbedTLS, Secure Transport, or
Microsoft Windows libraries at build-time to provide this functionality.
NTLM support requires OpenSSL, GnuTLS, mbedTLS or Microsoft Windows
libraries at build-time to provide this functionality.
4.10 My HTTP request using HEAD, PUT or DELETE does not work

6
docs/INSTALL-CMAKE.md
View file

@ -235,7 +235,7 @@ target_link_libraries(my_target PRIVATE CURL::libcurl)
- `CURL_COMPLETION_ZSH_DIR`: Custom zsh completion install directory.
- `CURL_DEFAULT_SSL_BACKEND`: Override default TLS backend in MultiSSL builds.
Accepted values in order of default priority:
`wolfssl`, `gnutls`, `mbedtls`, `openssl`, `secure-transport`, `schannel`, `bearssl`, `rustls`
`wolfssl`, `gnutls`, `mbedtls`, `openssl`, `schannel`, `rustls`
- `CURL_ENABLE_EXPORT_TARGET`: Enable CMake export target. Default: `ON`
- `CURL_HIDDEN_SYMBOLS`: Hide libcurl internal symbols (=hide all symbols that are not officially external). Default: `ON`
- `CURL_LIBCURL_SOVERSION`: Enable libcurl SOVERSION. Default: `ON` for supported platforms
@ -354,7 +354,6 @@ Details via CMake
## Dependencies
- `CURL_BROTLI`: Use brotli (`ON`, `OFF` or `AUTO`). Default: `AUTO`
- `CURL_USE_BEARSSL`: Enable BearSSL for SSL/TLS. Default: `OFF`
- `CURL_USE_GNUTLS`: Enable GnuTLS for SSL/TLS. Default: `OFF`
- `CURL_USE_GSASL`: Use libgsasl. Default: `OFF`
- `CURL_USE_GSSAPI`: Use GSSAPI implementation. Default: `OFF`
@ -367,7 +366,6 @@ Details via CMake
- `CURL_USE_PKGCONFIG`: Enable `pkg-config` to detect dependencies. Default: `ON` for Unix (except Android, Apple devices), vcpkg, MinGW if not cross-compiling.
- `CURL_USE_RUSTLS`: Enable Rustls for SSL/TLS. Default: `OFF`
- `CURL_USE_SCHANNEL`: Enable Windows native SSL/TLS (Schannel). Default: `OFF`
- `CURL_USE_SECTRANSP`: Enable Apple OS native SSL/TLS (Secure Transport). Default: `OFF`
- `CURL_USE_WOLFSSH`: Use wolfSSH. Default: `OFF`
- `CURL_USE_WOLFSSL`: Enable wolfSSL for SSL/TLS. Default: `OFF`
- `CURL_ZLIB`: Use zlib (`ON`, `OFF` or `AUTO`). Default: `AUTO`
@ -404,8 +402,6 @@ Details via CMake
- `AMISSL_INCLUDE_DIR`: The AmiSSL include directory.
- `AMISSL_STUBS_LIBRARY`: Path to `amisslstubs` library.
- `AMISSL_AUTO_LIBRARY`: Path to `amisslauto` library.
- `BEARSSL_INCLUDE_DIR`: The BearSSL include directory.
- `BEARSSL_LIBRARY`: Path to `bearssl` library.
- `BROTLI_INCLUDE_DIR`: The brotli include directory.
- `BROTLICOMMON_LIBRARY`: Path to `brotlicommon` library.
- `BROTLIDEC_LIBRARY`: Path to `brotlidec` library.

81
docs/INSTALL.md
View file

@ -137,13 +137,11 @@ alter it, you can select how to deal with each individual library.
These options are provided to select the TLS backend to use.
- AmiSSL: `--with-amissl`
- BearSSL: `--with-bearssl`
- GnuTLS: `--with-gnutls`.
- mbedTLS: `--with-mbedtls`
- OpenSSL: `--with-openssl` (also for BoringSSL, AWS-LC, LibreSSL, and quictls)
- rustls: `--with-rustls`
- Schannel: `--with-schannel`
- Secure Transport: `--with-secure-transport`
- wolfSSL: `--with-wolfssl`
You can build curl with *multiple* TLS backends at your choice, but some TLS
@ -396,85 +394,6 @@ support the legacy handshakes and algorithms used by those versions. If you
are using curl in one of those earlier versions of Windows you should choose
another SSL backend such as OpenSSL.
# Apple Platforms (macOS, iOS, tvOS, watchOS, and their simulator counterparts)
On modern Apple operating systems, curl can be built to use Apple's SSL/TLS
implementation, Secure Transport, instead of OpenSSL. To build with Secure
Transport for SSL/TLS, use the configure option `--with-secure-transport`.
When Secure Transport is in use, the curl options `--cacert` and `--capath`
and their libcurl equivalents, are ignored, because Secure Transport uses the
certificates stored in the Keychain to evaluate whether or not to trust the
server. This, of course, includes the root certificates that ship with the OS.
The `--cert` and `--engine` options, and their libcurl equivalents, are
currently unimplemented in curl with Secure Transport.
In general, a curl build for an Apple `ARCH/SDK/DEPLOYMENT_TARGET` combination
can be taken by providing appropriate values for `ARCH`, `SDK`, `DEPLOYMENT_TARGET`
below and running the commands:
```bash
# Set these three according to your needs
export ARCH=x86_64
export SDK=macosx
export DEPLOYMENT_TARGET=10.8
export CFLAGS="-arch $ARCH -isysroot $(xcrun -sdk $SDK --show-sdk-path) -m$SDK-version-min=$DEPLOYMENT_TARGET"
./configure --host=$ARCH-apple-darwin --prefix $(pwd)/artifacts --with-secure-transport
make -j8
make install
```
With CMake:
```bash
cmake . \
-DCMAKE_OSX_ARCHITECTURES=x86_64 \
-DCMAKE_OSX_DEPLOYMENT_TARGET=10.8 \
-DCMAKE_OSX_SYSROOT="$(xcrun --sdk macosx --show-sdk-path)"
```
The above command lines build curl for macOS platform with `x86_64`
architecture and `10.8` as deployment target.
Here is an example for iOS device:
```bash
export ARCH=arm64
export SDK=iphoneos
export DEPLOYMENT_TARGET=11.0
export CFLAGS="-arch $ARCH -isysroot $(xcrun -sdk $SDK --show-sdk-path) -m$SDK-version-min=$DEPLOYMENT_TARGET"
./configure --host=$ARCH-apple-darwin --prefix $(pwd)/artifacts --with-secure-transport
make -j8
make install
```
With CMake (3.16 or upper recommended):
```bash
cmake . \
-DCMAKE_SYSTEM_NAME=iOS \
-DCMAKE_OSX_ARCHITECTURES=arm64 \
-DCMAKE_OSX_DEPLOYMENT_TARGET=11.0
```
Another example for watchOS simulator for macs with Apple Silicon:
```bash
export ARCH=arm64
export SDK=watchsimulator
export DEPLOYMENT_TARGET=5.0
export CFLAGS="-arch $ARCH -isysroot $(xcrun -sdk $SDK --show-sdk-path) -m$SDK-version-min=$DEPLOYMENT_TARGET"
./configure --host=$ARCH-apple-darwin --prefix $(pwd)/artifacts --with-secure-transport
make -j8
make install
```
In all above, the built libraries and executables can be found in the
`artifacts` folder.
# Android
When building curl for Android you can you CMake or curl's `configure` script.

20
docs/KNOWN_BUGS
View file

@ -15,8 +15,7 @@ problems may have been fixed or changed somewhat since this was written.
2. TLS
2.1 IMAPS connection fails with Rustls error
2.3 Unable to use PKCS12 certificate with Secure Transport
2.4 Secure Transport does not import PKCS#12 client certificates without a password
2.5 Client cert handling with Issuer DN differs between backends
2.7 Client cert (MTLS) issues with Schannel
2.11 Schannel TLS 1.2 handshake bug in old Windows versions
2.13 CURLOPT_CERTINFO results in CURLE_OUT_OF_MEMORY with Schannel
@ -53,7 +52,6 @@ problems may have been fixed or changed somewhat since this was written.
6.9 SHA-256 digest not supported in Windows SSPI builds
6.10 curl never completes Negotiate over HTTP
6.11 Negotiate on Windows fails
6.12 cannot use Secure Transport with Crypto Token Kit
6.13 Negotiate against Hadoop HDFS
7. FTP
@ -122,15 +120,13 @@ problems may have been fixed or changed somewhat since this was written.
https://github.com/curl/curl/issues/10457
2.3 Unable to use PKCS12 certificate with Secure Transport
2.5 Client cert handling with Issuer DN differs between backends
See https://github.com/curl/curl/issues/5403
When the specified client certificate does not match any of the
server-specified DNs, the OpenSSL and GnuTLS backends behave differently.
The github discussion may contain a solution.
2.4 Secure Transport does not import PKCS#12 client certificates without a password
libcurl calls SecPKCS12Import with the PKCS#12 client certificate, but that
function rejects certificates that do not have a password.
https://github.com/curl/curl/issues/1308
See https://github.com/curl/curl/issues/1411
2.7 Client cert (MTLS) issues with Schannel
@ -368,10 +364,6 @@ problems may have been fixed or changed somewhat since this was written.
https://github.com/curl/curl/issues/5881
6.12 cannot use Secure Transport with Crypto Token Kit
https://github.com/curl/curl/issues/7048
6.13 Negotiate authentication against Hadoop HDFS
https://github.com/curl/curl/issues/8264

20
docs/SSLCERTS.md
View file

@ -8,9 +8,9 @@ SPDX-License-Identifier: curl
## Native vs file based
If curl was built with Schannel or Secure Transport support, then curl uses
the system native CA store for verification. All other TLS libraries use a
file based CA store by default.
If curl was built with Schannel support, then curl uses the system native CA
store for verification. All other TLS libraries use a file based CA store by
default.
## Verification
@ -102,17 +102,13 @@ latest Firefox bundle.
## Native CA store
If curl was built with Schannel, Secure Transport or were instructed to use
the native CA Store, then curl uses the certificates that are built into the
OS. These are the same certificates that appear in the Internet Options
control panel (under Windows) or Keychain Access application (under macOS).
Any custom security rules for certificates are honored.
If curl was built with Schannel or was instructed to use the native CA Store,
then curl uses the certificates that are built into the OS. These are the same
certificates that appear in the Internet Options control panel (under Windows)
or Keychain Access application (under macOS). Any custom security rules for
certificates are honored.
Schannel runs CRL checks on certificates unless peer verification is disabled.
Secure Transport on iOS runs OCSP checks on certificates unless peer
verification is disabled. Secure Transport on macOS runs either OCSP or CRL
checks on certificates if those features are enabled, and this behavior can be
adjusted in the preferences of Keychain Access.
## HTTPS proxy

4
docs/cmdline-opts/_ENVIRONMENT.md
View file

@ -72,8 +72,8 @@ the case insensitive name of the particular backend to use when curl is
invoked. Setting a name that is not a built-in alternative makes curl stay
with the default.
SSL backend names (case-insensitive): **bearssl**, **gnutls**, **mbedtls**,
**openssl**, **rustls**, **schannel**, **secure-transport**, **wolfssl**
SSL backend names (case-insensitive): **gnutls**, **mbedtls**, **openssl**,
**rustls**, **schannel**, **wolfssl**
## `HOME` <dir>
If set, this is used to find the home directory when that is needed. Like when

14
docs/cmdline-opts/cacert.md
View file

@ -34,13 +34,7 @@ Current Working Directory, or in any folder along your PATH.
curl 8.11.0 added a build-time option to disable this search behavior, and
another option to restrict search to the application's directory.
(iOS and macOS only) If curl is built against Secure Transport, then this
option is supported for backward compatibility with other SSL engines, but it
should not be set. If the option is not set, then curl uses the certificates
in the system and user Keychain to verify the peer, which is the preferred
method of verifying the peer's certificate chain.
(Schannel only) This option is supported for Schannel in Windows 7 or later
(added in 7.60.0). This option is supported for backward compatibility with
other SSL engines; instead it is recommended to use Windows' store of root
certificates (the default for Schannel).
(Schannel) This option is supported for Schannel in Windows 7 or later (added
in 7.60.0). This option is supported for backward compatibility with other SSL
engines; instead it is recommended to use Windows' store of root certificates
(the default for Schannel).

6
docs/cmdline-opts/cert-type.md
View file

@ -21,6 +21,6 @@ Example:
Set type of the provided client certificate. PEM, DER, ENG, PROV and P12 are
recognized types.
The default type depends on the TLS backend and is usually PEM, however for
Secure Transport and Schannel it is P12. If --cert is a pkcs11: URI then ENG
or PROV is the default type (depending on OpenSSL version).
The default type depends on the TLS backend and is usually PEM. For Schannel
it is P12. If --cert is a pkcs11: URI then ENG or PROV is the default type
(depending on OpenSSL version).

13
docs/cmdline-opts/cert.md
View file

@ -20,8 +20,7 @@ Example:
# `--cert`
Use the specified client certificate file when getting a file with HTTPS, FTPS
or another SSL-based protocol. The certificate must be in PKCS#12 format if
using Secure Transport, or PEM format if using any other engine. If the
or another SSL-based protocol. The certificate must be PEM format. If the
optional password is not specified, it is queried for on the terminal. Note
that this option assumes a certificate file that is the private key and the
client certificate concatenated. See --cert and --key to specify them
@ -43,14 +42,8 @@ If curl is built against GnuTLS, a PKCS#11 URI can be used to specify
a certificate located in a PKCS#11 device. A string beginning with `pkcs11:`
is interpreted as a PKCS#11 URI.
(iOS and macOS only) If curl is built against Secure Transport, then the
certificate string can either be the name of a certificate/private key in the
system or user keychain, or the path to a PKCS#12-encoded certificate and
private key. If you want to use a file from the current directory, please
precede it with `./` prefix, in order to avoid confusion with a nickname.
(Schannel only) Client certificates must be specified by a path expression to
a certificate store. (Loading *PFX* is not supported; you can import it to a
(Schannel) Client certificates must be specified by a path expression to a
certificate store. (Loading *PFX* is not supported; you can import it to a
store first). You can use "\<store location\>\\<store name\>\\<thumbprint\>"
to refer to a certificate in the system certificates store, for example,
*"CurrentUser\MY\934a7ac6f8a5d579285a74fa61e19f23ddfe8d7a"*. Thumbprint is

5
docs/cmdline-opts/false-start.md
View file

@ -15,9 +15,8 @@ Example:
# `--false-start`
No TLS backend currently supports this feature.
Use false start during the TLS handshake. False start is a mode where a TLS
client starts sending application data before verifying the server's Finished
message, thus saving a round trip when performing a full handshake.
This functionality is currently only implemented in the Secure Transport (on
iOS 7.0 or later, or macOS 10.9 or later) backend.

7
docs/cmdline-opts/key.md
View file

@ -28,7 +28,6 @@ interpreted as a PKCS#11 URI. If a PKCS#11 URI is provided, then the --engine
option is set as `pkcs11` if none was provided and the --key-type option is
set as `ENG` or `PROV` if none was provided (depending on OpenSSL version).
If curl is built against Secure Transport or Schannel then this option is
ignored for TLS protocols (HTTPS, etc). Those backends expect the private key
to be already present in the keychain or PKCS#12 file containing the
certificate.
If curl is built against Schannel then this option is ignored for TLS
protocols (HTTPS, etc). That backend expects the private key to be already
present in the keychain or PKCS#12 file containing the certificate.

7
docs/cmdline-opts/pinnedpubkey.md
View file

@ -33,14 +33,11 @@ together then the peer is still verified by public key.
PEM/DER support:
OpenSSL and GnuTLS (added in 7.39.0), wolfSSL (added in 7.43.0),
mbedTLS (added in 7.47.0),
Secure Transport macOS 10.7+/iOS 10+ (added in 7.54.1),
Schannel (added in 7.58.1)
mbedTLS (added in 7.47.0), Schannel (added in 7.58.1)
sha256 support:
OpenSSL, GnuTLS and wolfSSL (added in 7.44.0), mbedTLS (added in 7.47.0),
Secure Transport macOS 10.7+/iOS 10+ (added in 7.54.1), Schannel
(added in 7.58.1)
Schannel (added in 7.58.1)
Other SSL backends not supported.

6
docs/cmdline-opts/proxy-cert-type.md
View file

@ -19,8 +19,8 @@ Example:
Set type of the provided client certificate when using HTTPS proxy. PEM, DER,
ENG, PROV and P12 are recognized types.
The default type depends on the TLS backend and is usually PEM, however for
Secure Transport and Schannel it is P12. If --proxy-cert is a pkcs11: URI then
ENG or PROV is the default type (depending on OpenSSL version).
The default type depends on the TLS backend and is usually PEM. For Schannel
it is P12. If --proxy-cert is a pkcs11: URI then ENG or PROV is the default
type (depending on OpenSSL version).
Equivalent to --cert-type but used in HTTPS proxy context.

3
docs/cmdline-opts/proxy-cert.md
View file

@ -18,8 +18,7 @@ Example:
# `--proxy-cert`
Use the specified client certificate file when communicating with an HTTPS
proxy. The certificate must be in PKCS#12 format if using Secure Transport, or
PEM format if using any other engine. If the optional password is not
proxy. The certificate must be PEM format. If the optional password is not
specified, it is queried for on the terminal. Use --proxy-key to provide the
private key.

6
docs/cmdline-opts/proxy.md
View file

@ -27,9 +27,9 @@ used. (Added in 7.21.7)
Unix domain sockets are supported for socks proxy. Set localhost for the host
part. e.g. socks5h://localhost/path/to/socket.sock
HTTPS proxy support works with the https:// protocol prefix for OpenSSL
and GnuTLS (added in 7.52.0). It also works for BearSSL, mbedTLS, Rustls,
Schannel, Secure Transport and wolfSSL (added in 7.87.0).
HTTPS proxy support works with the https:// protocol prefix for OpenSSL and
GnuTLS (added in 7.52.0). It also works for BearSSL, mbedTLS, Rustls, Schannel
and wolfSSL (added in 7.87.0).
Unrecognized and unsupported proxy protocols cause an error (added in 7.52.0).
Ancient curl versions ignored unknown schemes and used http:// instead.

5
docs/cmdline-opts/write-out.md
View file

@ -62,7 +62,7 @@ The variables available are:
## `certs`
Output the certificate chain with details. Supported only by the OpenSSL,
GnuTLS, Schannel, Rustls, and Secure Transport backends. (Added in 7.88.0)
GnuTLS, Schannel and Rustls backends. (Added in 7.88.0)
## `conn_id`
The connection identifier last used by the transfer. The connection id is
@ -128,8 +128,7 @@ The http method used in the most recent HTTP request. (Added in 7.72.0)
## `num_certs`
Number of server certificates received in the TLS handshake. Supported only by
the OpenSSL, GnuTLS, Schannel, Rustls and Secure Transport backends.
(Added in 7.88.0)
the OpenSSL, GnuTLS, Schannel and Rustls backends. (Added in 7.88.0)
## `num_connects`
Number of new connects made in the recent transfer. (Added in 7.12.3)

1
docs/libcurl/curl_easy_ssls_export.md
View file

@ -13,7 +13,6 @@ Protocol:
TLS-backend:
- GnuTLS
- OpenSSL
- BearSSL
- wolfSSL
- mbedTLS
Added-in: 8.12.0

1
docs/libcurl/curl_easy_ssls_import.md
View file

@ -13,7 +13,6 @@ Protocol:
TLS-backend:
- GnuTLS
- OpenSSL
- BearSSL
- wolfSSL
- mbedTLS
Added-in: 8.12.0

16
docs/libcurl/curl_global_sslset.md
View file

@ -66,15 +66,15 @@ This does not just mean no other thread that is using libcurl.
# Names
SSL backend names (case-insensitive): BearSSL, GnuTLS, mbedTLS, OpenSSL,
Rustls, Schannel, Secure-Transport, wolfSSL
SSL backend names (case-insensitive): GnuTLS, mbedTLS, OpenSSL, Rustls,
Schannel, wolfSSL
The name "OpenSSL" is used for all versions of OpenSSL and its associated
forks/flavors in this function. OpenSSL, BoringSSL, LibreSSL, quictls and
AmiSSL are all supported by libcurl, but in the eyes of
curl_global_sslset(3) they are all just "OpenSSL". They all mostly
provide the same API. curl_version_info(3) can return more specific info about
the exact OpenSSL flavor and version number in use.
AmiSSL are all supported by libcurl, but in the eyes of curl_global_sslset(3)
they are all just "OpenSSL". They all mostly provide the same API.
curl_version_info(3) can return more specific info about the exact OpenSSL
flavor and version number in use.
# struct
@ -93,11 +93,11 @@ typedef enum {
CURLSSLBACKEND_POLARSSL = 6, /* deprecated */
CURLSSLBACKEND_WOLFSSL = 7,
CURLSSLBACKEND_SCHANNEL = 8,
CURLSSLBACKEND_SECURETRANSPORT = 9,
CURLSSLBACKEND_SECURETRANSPORT = 9, /* deprecated */
CURLSSLBACKEND_AXTLS = 10, /* deprecated */
CURLSSLBACKEND_MBEDTLS = 11,
CURLSSLBACKEND_MESALINK = 12, /* deprecated */
CURLSSLBACKEND_BEARSSL = 13,
CURLSSLBACKEND_BEARSSL = 13, /* deprecated */
CURLSSLBACKEND_RUSTLS = 14
} curl_sslbackend;
~~~

4
docs/libcurl/libcurl-env.md
View file

@ -51,8 +51,8 @@ backend at first use. If no selection is done by the program using libcurl,
this variable's selection is used. Setting a name that is not a built-in
alternative makes libcurl stay with the default.
SSL backend names (case-insensitive): BearSSL, GnuTLS, mbedTLS, OpenSSL,
Rustls, Schannel, Secure-Transport, wolfSSL
SSL backend names (case-insensitive): GnuTLS, mbedTLS, OpenSSL, Rustls,
Schannel, wolfSSL
## `HOME`

5
docs/libcurl/opts/CURLINFO_CERTINFO.md
View file

@ -14,7 +14,6 @@ TLS-backend:
- OpenSSL
- GnuTLS
- Schannel
- Secure Transport
- rustls
Added-in: 7.19.1
---
@ -97,8 +96,8 @@ See also the *certinfo.c* example.
# HISTORY
GnuTLS support added in 7.42.0. Schannel support added in 7.50.0. Secure
Transport support added in 7.79.0. mbedTLS support added in 8.9.0.
GnuTLS support added in 7.42.0. Schannel support added in 7.50.0. mbedTLS
support added in 8.9.0.
# %AVAILABILITY%

6
docs/libcurl/opts/CURLINFO_TLS_SSL_PTR.md
View file

@ -11,12 +11,10 @@ See-also:
Protocol:
- TLS
TLS-backend:
- BearSSL
- GnuTLS
- mbedTLS
- OpenSSL
- Schannel
- Secure Transport
- wolfSSL
Added-in: 7.48.0
---
@ -87,10 +85,6 @@ as well:
**CtxtHandle ***
## Secure Transport
**SSLContext ***
## wolfSSL
**SSL ***

8
docs/libcurl/opts/CURLOPT_ALTSVC_CTRL.md
View file

@ -35,10 +35,10 @@ CURLcode curl_easy_setopt(CURL *handle, CURLOPT_ALTSVC_CTRL, long bitmask);
Populate the long *bitmask* with the correct set of features to instruct
libcurl how to handle Alt-Svc for the transfers using this handle.
libcurl only accepts Alt-Svc headers over a Secure Transport, meaning
HTTPS. It also only completes a request to an alternative origin if that
origin is properly hosted over HTTPS. These requirements are there to make
sure both the source and the destination are legitimate.
libcurl only accepts Alt-Svc headers over HTTPS. It also only completes a
request to an alternative origin if that origin is properly hosted over HTTPS.
These requirements are there to make sure both the source and the destination
are legitimate.
Alternative services are only used when setting up new connections. If there
exists an existing connection to the host in the connection pool, then that is

8
docs/libcurl/opts/CURLOPT_CAINFO.md
View file

@ -42,10 +42,6 @@ accessible file.
This option is by default set to the system path where libcurl's CA
certificate bundle is assumed to be stored, as established at build time.
(iOS and macOS) When curl uses Secure Transport this option is supported. If
the option is not set, then curl uses the certificates in the system and user
Keychain to verify the peer.
(Schannel) This option is supported for Schannel in Windows 7 or later but we
recommend not using it until Windows 8 since it works better starting then.
If the option is not set, then curl uses the certificates in the Windows'
@ -61,8 +57,8 @@ The default value for this can be figured out with CURLINFO_CAINFO(3).
# DEFAULT
Built-in system specific. When curl is built with Secure Transport or
Schannel, this option is not set by default.
Built-in system specific. When curl is built with Schannel, this option is not
set by default.
# %PROTOCOLS%

7
docs/libcurl/opts/CURLOPT_CAINFO_BLOB.md
View file

@ -12,12 +12,10 @@ See-also:
- CURLOPT_SSL_VERIFYHOST (3)
- CURLOPT_SSL_VERIFYPEER (3)
TLS-backend:
- BearSSL
- OpenSSL
- mbedTLS
- rustls
- wolfSSL
- Secure Transport
- Schannel
Added-in: 7.77.0
---
@ -81,9 +79,8 @@ int main(void)
# HISTORY
This option is supported by the BearSSL (since 7.79.0), mbedTLS (since
7.81.0), Rustls (since 7.82.0), wolfSSL (since 8.2.0), OpenSSL, Secure
Transport and Schannel backends.
This option is supported by the mbedTLS (since 7.81.0), Rustls (since 7.82.0),
wolfSSL (since 8.2.0), OpenSSL and Schannel backends.
# %AVAILABILITY%

4
docs/libcurl/opts/CURLOPT_CERTINFO.md
View file

@ -16,7 +16,6 @@ TLS-backend:
- OpenSSL
- GnuTLS
- Schannel
- Secure Transport
- rustls
Added-in: 7.19.1
---
@ -88,8 +87,7 @@ int main(void)
# HISTORY
Schannel support added in 7.50.0. Secure Transport support added in 7.79.0.
mbedTLS support added in 8.9.0.
Schannel support added in 7.50.0. mbedTLS support added in 8.9.0.
# %AVAILABILITY%

5
docs/libcurl/opts/CURLOPT_PINNEDPUBLICKEY.md
View file

@ -16,7 +16,6 @@ TLS-backend:
- GnuTLS
- wolfSSL
- mbedTLS
- Secure Transport
- Schannel
Added-in: 7.39.0
---
@ -129,8 +128,6 @@ footer:
7.47.0: mbedTLS
7.54.1: Secure Transport on macOS 10.7+/iOS 10+
7.58.1: Schannel
## sha256 support
@ -139,8 +136,6 @@ footer:
7.47.0: mbedTLS
7.54.1: Secure Transport on macOS 10.7+/iOS 10+
7.58.1: Schannel
Other SSL backends not supported.

5
docs/libcurl/opts/CURLOPT_PROXY.md
View file

@ -53,9 +53,8 @@ HTTP Proxy. Default when no scheme or proxy type is specified.
## https://
HTTPS Proxy. (Added in 7.52.0 for OpenSSL and GnuTLS Since 7.87.0, it
also works for BearSSL, mbedTLS, Rustls, Schannel, Secure Transport and
wolfSSL.)
HTTPS Proxy. (Added in 7.52.0 for OpenSSL and GnuTLS Since 7.87.0, it also
works for mbedTLS, Rustls, Schannel and wolfSSL.)
This uses HTTP/1 by default. Setting CURLOPT_PROXYTYPE(3) to
**CURLPROXY_HTTPS2** allows libcurl to negotiate using HTTP/2 with proxy.

3
docs/libcurl/opts/CURLOPT_PROXYTYPE.md
View file

@ -35,8 +35,7 @@ HTTP Proxy. Default.
## CURLPROXY_HTTPS
HTTPS Proxy using HTTP/1. (Added in 7.52.0 for OpenSSL and GnuTLS. Since
7.87.0, it also works for BearSSL, mbedTLS, Rustls, Schannel, Secure Transport
and wolfSSL.)
7.87.0, it also works for mbedTLS, Rustls, Schannel and wolfSSL.)
## CURLPROXY_HTTPS2

6
docs/libcurl/opts/CURLOPT_PROXY_CAINFO.md
View file

@ -47,12 +47,6 @@ accessible file.
This option is by default set to the system path where libcurl's CA
certificate bundle is assumed to be stored, as established at build time.
(iOS and macOS only) If curl is built against Secure Transport, then this
option is supported for backward compatibility with other SSL engines, but it
should not be set. If the option is not set, then curl uses the certificates
in the system and user Keychain to verify the peer, which is the preferred
method of verifying the peer's certificate chain.
The application does not have to keep the string around after setting this
option.

1
docs/libcurl/opts/CURLOPT_PROXY_CAINFO_BLOB.md
View file

@ -19,7 +19,6 @@ Protocol:
TLS-backend:
- OpenSSL
- rustls
- Secure Transport
- Schannel
Added-in: 7.77.0
---

10
docs/libcurl/opts/CURLOPT_PROXY_SSLCERT.md
View file

@ -15,7 +15,6 @@ TLS-backend:
- GnuTLS
- mbedTLS
- Schannel
- Secure Transport
- wolfSSL
Added-in: 7.52.0
---
@ -38,13 +37,8 @@ This option is for connecting to an HTTPS proxy, not an HTTPS server.
Pass a pointer to a null-terminated string as parameter. The string should be
the filename of your client certificate used to connect to the HTTPS proxy.
The default format is "P12" on Secure Transport and "PEM" on other engines,
and can be changed with CURLOPT_PROXY_SSLCERTTYPE(3).
With Secure Transport, this can also be the nickname of the certificate you
wish to authenticate with as it is named in the security database. If you want
to use a file from the current directory, please precede it with "./" prefix,
in order to avoid confusion with a nickname.
The default format "PEM", and can be changed with
CURLOPT_PROXY_SSLCERTTYPE(3).
When using a client certificate, you most likely also need to provide a
private key with CURLOPT_PROXY_SSLKEY(3).

7
docs/libcurl/opts/CURLOPT_PROXY_SSLCERTTYPE.md
View file

@ -15,7 +15,6 @@ TLS-backend:
- GnuTLS
- mbedTLS
- Schannel
- Secure Transport
- wolfSSL
Added-in: 7.52.0
---
@ -37,10 +36,8 @@ CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_SSLCERTTYPE, char *type);
Pass a pointer to a null-terminated string as parameter. The string should be
the format of your client certificate used when connecting to an HTTPS proxy.
Supported formats are "PEM" and "DER", except with Secure Transport or
Schannel. OpenSSL (versions 0.9.3 and later), Secure Transport (on iOS 5 or
later, or macOS 10.7 or later) and Schannel support "P12" for PKCS#12-encoded
files.
Supported formats are "PEM" and "DER", except with Schannel. OpenSSL and
Schannel support "P12" for PKCS#12-encoded files.
The application does not have to keep the string around after setting this
option.

7
docs/libcurl/opts/CURLOPT_PROXY_SSLCERT_BLOB.md
View file

@ -14,7 +14,6 @@ Protocol:
TLS-backend:
- OpenSSL
- Schannel
- Secure Transport
Added-in: 7.71.0
---
@ -35,9 +34,9 @@ CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_SSLCERT_BLOB,
Pass a pointer to a curl_blob structure, which contains information (pointer
and size) about a memory block with binary data of the certificate used to
connect to the HTTPS proxy. The format must be "P12" on Secure Transport or
Schannel. The format must be "P12" or "PEM" on OpenSSL. The string "P12" or
"PEM" must be specified with CURLOPT_PROXY_SSLCERTTYPE(3).
connect to the HTTPS proxy. The format must be "P12" on Schannel. The format
must be "P12" or "PEM" on OpenSSL. The string "P12" or "PEM" must be specified
with CURLOPT_PROXY_SSLCERTTYPE(3).
If the blob is initialized with the flags member of struct curl_blob set to
CURL_BLOB_COPY, the application does not have to keep the buffer around after

6
docs/libcurl/opts/CURLOPT_PROXY_SSLKEY.md
View file

@ -39,9 +39,9 @@ the filename of your private key used for connecting to the HTTPS proxy. The
default format is "PEM" and can be changed with
CURLOPT_PROXY_SSLKEYTYPE(3).
(Windows, iOS and macOS) This option is ignored by Secure Transport and
Schannel SSL backends because they expect the private key to be already
present in the key chain or PKCS#12 file containing the certificate.
This option is ignored by the Schannel backend because it expects the private
key to be already present in the key chain or PKCS#12 file containing the
certificate.
The application does not have to keep the string around after setting this
option.

1
docs/libcurl/opts/CURLOPT_PROXY_SSLKEYTYPE.md
View file

@ -12,7 +12,6 @@ Protocol:
- TLS
TLS-backend:
- OpenSSL
- BearSSL
- wolfSSL
Added-in: 7.52.0
---

4
docs/libcurl/opts/CURLOPT_PROXY_SSL_CIPHER_LIST.md
View file

@ -14,9 +14,7 @@ Protocol:
- TLS
TLS-backend:
- OpenSSL
- BearSSL
- Schannel
- Secure Transport
- wolfSSL
- mbedTLS
- rustls
@ -92,7 +90,7 @@ int main(void)
# HISTORY
OpenSSL support added in 7.52.0.
wolfSSL, Schannel, Secure Transport, and BearSSL support added in 7.87.0
wolfSSL, Schannel support added in 7.87.0
mbedTLS support added in 8.8.0.
Rustls support added in 8.10.0.

13
docs/libcurl/opts/CURLOPT_SSLCERT.md
View file

@ -15,7 +15,6 @@ TLS-backend:
- GnuTLS
- mbedTLS
- Schannel
- Secure Transport
- wolfSSL
Added-in: 7.1
---
@ -35,16 +34,10 @@ CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSLCERT, char *cert);
# DESCRIPTION
Pass a pointer to a null-terminated string as parameter. The string should be
the filename of your client certificate. The default format is `P12` on Secure
Transport and `PEM` on other engines, and can be changed with
CURLOPT_SSLCERTTYPE(3).
the filename of your client certificate. The default format is `PEM` but can
be changed with CURLOPT_SSLCERTTYPE(3).
With Secure Transport, this can also be the nickname of the certificate you
wish to authenticate with as it is named in the security database. If you want
to use a file from the current directory, please precede it with `./` prefix,
in order to avoid confusion with a nickname.
(Schannel only) Client certificates can be specified by a path expression to a
(Schannel) Client certificates can be specified by a path expression to a
certificate store. (You can import *PFX* to a store first). You can use
"\<store location\>\\\<store name\>\\\<thumbprint\>" to refer to a certificate
in the system certificates store, for example,

8
docs/libcurl/opts/CURLOPT_SSLCERTTYPE.md
View file

@ -14,7 +14,6 @@ TLS-backend:
- GnuTLS
- mbedTLS
- Schannel
- Secure Transport
- wolfSSL
Added-in: 7.9.3
---
@ -36,10 +35,9 @@ CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSLCERTTYPE, char *type);
Pass a pointer to a null-terminated string as parameter. The string should be
the format of your certificate.
Supported formats are "PEM" and "DER", except with Secure Transport or
Schannel. OpenSSL (versions 0.9.3 and later), Secure Transport (on iOS 5 or
later, or macOS 10.7 or later) and Schannel support "P12" for PKCS#12-encoded
files. GnuTLS supports P12 starting with curl 8.11.0.
Supported formats are "PEM" and "DER", except with Schannel. OpenSSL and
Schannel support "P12" for PKCS#12-encoded files. GnuTLS supports P12 starting
with curl 8.11.0.
The application does not have to keep the string around after setting this
option.

8
docs/libcurl/opts/CURLOPT_SSLCERT_BLOB.md
View file

@ -12,7 +12,6 @@ Protocol:
- TLS
TLS-backend:
- OpenSSL
- Secure Transport
- Schannel
- mbedTLS
- wolfSSL
@ -35,10 +34,9 @@ CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSLCERT_BLOB,
# DESCRIPTION
Pass a pointer to a curl_blob structure, which contains (pointer and size) a
client certificate. The format must be "P12" on Secure Transport or
Schannel. The format must be "P12" or "PEM" on OpenSSL. The format must be
"DER" or "PEM" on mbedTLS. The format must be specified with
CURLOPT_SSLCERTTYPE(3).
client certificate. The format must be "P12" on Schannel. The format must be
"P12" or "PEM" on OpenSSL. The format must be "DER" or "PEM" on mbedTLS. The
format must be specified with CURLOPT_SSLCERTTYPE(3).
If the blob is initialized with the flags member of struct curl_blob set to
CURL_BLOB_COPY, the application does not have to keep the buffer around after

6
docs/libcurl/opts/CURLOPT_SSLKEY.md
View file

@ -36,9 +36,9 @@ Pass a pointer to a null-terminated string as parameter. The string should be
the filename of your private key. The default format is "PEM" and can be
changed with CURLOPT_SSLKEYTYPE(3).
(Windows, iOS and macOS) This option is ignored by Secure Transport and
Schannel SSL backends because they expect the private key to be already present
in the key-chain or PKCS#12 file containing the certificate.
(Windows) This option is ignored by the Schannel SSL backend because it
expects the private key to be already present in the key-chain or PKCS#12 file
containing the certificate.
The application does not have to keep the string around after setting this
option.

1
docs/libcurl/opts/CURLOPT_SSLKEYTYPE.md
View file

@ -12,7 +12,6 @@ Protocol:
- TLS
TLS-backend:
- OpenSSL
- BearSSL
- wolfSSL
Added-in: 7.9.3
---

4
docs/libcurl/opts/CURLOPT_SSL_CIPHER_LIST.md
View file

@ -14,9 +14,7 @@ Protocol:
- TLS
TLS-backend:
- OpenSSL
- BearSSL
- Schannel
- Secure Transport
- wolfSSL
- mbedTLS
- rustls
@ -98,8 +96,6 @@ int main(void)
OpenSSL support added in 7.9.
wolfSSL support added in 7.53.0.
Schannel support added in 7.61.0.
Secure Transport support added in 7.77.0.
BearSSL support added in 7.83.0.
mbedTLS support added in 8.8.0.
Rustls support added in 8.10.0.

4
docs/libcurl/opts/CURLOPT_SSL_CTX_DATA.md
View file

@ -13,7 +13,6 @@ TLS-backend:
- OpenSSL
- wolfSSL
- mbedTLS
- BearSSL
Added-in: 7.10.6
---
@ -118,8 +117,7 @@ int main(void)
# HISTORY
Added in 7.11.0 for OpenSSL, in 7.42.0 for wolfSSL, in 7.54.0 for mbedTLS,
in 7.83.0 in BearSSL.
Added in 7.11.0 for OpenSSL, in 7.42.0 for wolfSSL, in 7.54.0 for mbedTLS.
# %AVAILABILITY%

9
docs/libcurl/opts/CURLOPT_SSL_CTX_FUNCTION.md
View file

@ -17,7 +17,6 @@ TLS-backend:
- OpenSSL
- wolfSSL
- mbedTLS
- BearSSL
Added-in: 7.10.6
---
@ -46,10 +45,10 @@ of an SSL connection after having processed all other SSL related options to
give a last chance to an application to modify the behavior of the SSL
initialization. The *ssl_ctx* parameter is a pointer to the SSL library's
*SSL_CTX* for OpenSSL or wolfSSL, a pointer to *mbedtls_ssl_config* for
mbedTLS or a pointer to *br_ssl_client_context* for BearSSL. If an error is
returned from the callback no attempt to establish a connection is made and
the perform operation returns the callback's error code. Set the *clientp*
argument passed in to this callback with the CURLOPT_SSL_CTX_DATA(3) option.
mbedTLS. If an error is returned from the callback no attempt to establish a
connection is made and the perform operation returns the callback's error
code. Set the *clientp* argument passed in to this callback with the
CURLOPT_SSL_CTX_DATA(3) option.
This function gets called for all new connections made to a server, during the
SSL negotiation. While *ssl_ctx* points to a newly initialized object each

2
docs/libcurl/opts/CURLOPT_SSL_FALSESTART.md
View file

@ -9,7 +9,7 @@ See-also:
Protocol:
- TLS
TLS-backend:
- Secure Transport
- none
Added-in: 7.42.0
---

8
docs/libcurl/opts/CURLOPT_SSL_VERIFYHOST.md
View file

@ -73,14 +73,6 @@ A certificate can be set for a numerical IP address (IPv4 or IPv6), but then
it should be a Subject Alternate Name kind and its type should correctly
identify the field as an IP address.
# LIMITATIONS
Secure Transport: If *verify* value is 0, then SNI is also disabled. SNI is a
TLS extension that sends the hostname to the server. The server may use that
information to do such things as sending back a specific certificate for the
hostname, or forwarding the request to a specific origin server. Some
hostnames may be inaccessible if SNI is not sent.
# DEFAULT
2

2
docs/tests/FILEFORMAT.md
View file

@ -441,7 +441,6 @@ Features testable here are:
- `aws` - built with **aws-sigv4** support
- `AppleIDN`
- `asyn-rr` - c-ares is used for additional records only
- `bearssl`
- `brotli`
- `c-ares` - c-ares is used for (all) name resolves
- `CharConv`
@ -488,7 +487,6 @@ Features testable here are:
- `PSL`
- `rustls`
- `Schannel`
- `sectransp`
- `shuffle-dns`
- `socks`
- `SPNEGO`