TLS: remove support for Secure Transport and BearSSL

These libraries do not support TLS 1.3 and have been marked for removal
for over a year. We want to help users select a TLS dependency that is
future-proof and reliable, and not supporting TLS 1.3 in 2025 does not
infer confidence. Users who build libcurl are likely to be served better
and get something more future-proof with a TLS library that supports
1.3.

Closes #16677

docs/cmdline-opts/_ENVIRONMENT.md

@@ -72,8 +72,8 @@ the case insensitive name of the particular backend to use when curl is
 invoked. Setting a name that is not a built-in alternative makes curl stay
 with the default.
 
-SSL backend names (case-insensitive): **bearssl**, **gnutls**, **mbedtls**,
-**openssl**, **rustls**, **schannel**, **secure-transport**, **wolfssl**
+SSL backend names (case-insensitive): **gnutls**, **mbedtls**, **openssl**,
+**rustls**, **schannel**, **wolfssl**
 
 ## `HOME` <dir>
 If set, this is used to find the home directory when that is needed. Like when

docs/cmdline-opts/cacert.md

@@ -34,13 +34,7 @@ Current Working Directory, or in any folder along your PATH.
 curl 8.11.0 added a build-time option to disable this search behavior, and
 another option to restrict search to the application's directory.
 
-(iOS and macOS only) If curl is built against Secure Transport, then this
-option is supported for backward compatibility with other SSL engines, but it
-should not be set. If the option is not set, then curl uses the certificates
-in the system and user Keychain to verify the peer, which is the preferred
-method of verifying the peer's certificate chain.
-
-(Schannel only) This option is supported for Schannel in Windows 7 or later
-(added in 7.60.0). This option is supported for backward compatibility with
-other SSL engines; instead it is recommended to use Windows' store of root
-certificates (the default for Schannel).
+(Schannel) This option is supported for Schannel in Windows 7 or later (added
+in 7.60.0). This option is supported for backward compatibility with other SSL
+engines; instead it is recommended to use Windows' store of root certificates
+(the default for Schannel).

docs/cmdline-opts/cert-type.md

@@ -21,6 +21,6 @@ Example:
 Set type of the provided client certificate. PEM, DER, ENG, PROV and P12 are
 recognized types.
 
-The default type depends on the TLS backend and is usually PEM, however for
-Secure Transport and Schannel it is P12. If --cert is a pkcs11: URI then ENG
-or PROV is the default type (depending on OpenSSL version).
+The default type depends on the TLS backend and is usually PEM. For Schannel
+it is P12. If --cert is a pkcs11: URI then ENG or PROV is the default type
+(depending on OpenSSL version).

docs/cmdline-opts/cert.md

@@ -20,8 +20,7 @@ Example:
 # `--cert`
 
 Use the specified client certificate file when getting a file with HTTPS, FTPS
-or another SSL-based protocol. The certificate must be in PKCS#12 format if
-using Secure Transport, or PEM format if using any other engine. If the
+or another SSL-based protocol. The certificate must be PEM format. If the
 optional password is not specified, it is queried for on the terminal. Note
 that this option assumes a certificate file that is the private key and the
 client certificate concatenated. See --cert and --key to specify them
@@ -43,14 +42,8 @@ If curl is built against GnuTLS, a PKCS#11 URI can be used to specify
 a certificate located in a PKCS#11 device. A string beginning with `pkcs11:`
 is interpreted as a PKCS#11 URI.
 
-(iOS and macOS only) If curl is built against Secure Transport, then the
-certificate string can either be the name of a certificate/private key in the
-system or user keychain, or the path to a PKCS#12-encoded certificate and
-private key. If you want to use a file from the current directory, please
-precede it with `./` prefix, in order to avoid confusion with a nickname.
-
-(Schannel only) Client certificates must be specified by a path expression to
-a certificate store. (Loading *PFX* is not supported; you can import it to a
+(Schannel) Client certificates must be specified by a path expression to a
+certificate store. (Loading *PFX* is not supported; you can import it to a
 store first). You can use "\<store location\>\\<store name\>\\<thumbprint\>"
 to refer to a certificate in the system certificates store, for example,
 *"CurrentUser\MY\934a7ac6f8a5d579285a74fa61e19f23ddfe8d7a"*. Thumbprint is

docs/cmdline-opts/false-start.md

@@ -15,9 +15,8 @@ Example:
 
 # `--false-start`
 
+No TLS backend currently supports this feature.
+
 Use false start during the TLS handshake. False start is a mode where a TLS
 client starts sending application data before verifying the server's Finished
 message, thus saving a round trip when performing a full handshake.
-
-This functionality is currently only implemented in the Secure Transport (on
-iOS 7.0 or later, or macOS 10.9 or later) backend.

docs/cmdline-opts/key.md

@@ -28,7 +28,6 @@ interpreted as a PKCS#11 URI. If a PKCS#11 URI is provided, then the --engine
 option is set as `pkcs11` if none was provided and the --key-type option is
 set as `ENG` or `PROV` if none was provided (depending on OpenSSL version).
 
-If curl is built against Secure Transport or Schannel then this option is
-ignored for TLS protocols (HTTPS, etc). Those backends expect the private key
-to be already present in the keychain or PKCS#12 file containing the
-certificate.
+If curl is built against Schannel then this option is ignored for TLS
+protocols (HTTPS, etc). That backend expects the private key to be already
+present in the keychain or PKCS#12 file containing the certificate.

docs/cmdline-opts/pinnedpubkey.md

@@ -33,14 +33,11 @@ together then the peer is still verified by public key.
 PEM/DER support:
 
 OpenSSL and GnuTLS (added in 7.39.0), wolfSSL (added in 7.43.0),
-mbedTLS (added in 7.47.0),
-Secure Transport macOS 10.7+/iOS 10+ (added in 7.54.1),
-Schannel (added in 7.58.1)
+mbedTLS (added in 7.47.0), Schannel (added in 7.58.1)
 
 sha256 support:
 
 OpenSSL, GnuTLS and wolfSSL (added in 7.44.0), mbedTLS (added in 7.47.0),
-Secure Transport macOS 10.7+/iOS 10+ (added in 7.54.1), Schannel
-(added in 7.58.1)
+Schannel (added in 7.58.1)
 
 Other SSL backends not supported.

docs/cmdline-opts/proxy-cert-type.md

@@ -19,8 +19,8 @@ Example:
 Set type of the provided client certificate when using HTTPS proxy. PEM, DER,
 ENG, PROV and P12 are recognized types.
 
-The default type depends on the TLS backend and is usually PEM, however for
-Secure Transport and Schannel it is P12. If --proxy-cert is a pkcs11: URI then
-ENG or PROV is the default type (depending on OpenSSL version).
+The default type depends on the TLS backend and is usually PEM. For Schannel
+it is P12. If --proxy-cert is a pkcs11: URI then ENG or PROV is the default
+type (depending on OpenSSL version).
 
 Equivalent to --cert-type but used in HTTPS proxy context.

docs/cmdline-opts/proxy-cert.md

@@ -18,8 +18,7 @@ Example:
 # `--proxy-cert`
 
 Use the specified client certificate file when communicating with an HTTPS
-proxy. The certificate must be in PKCS#12 format if using Secure Transport, or
-PEM format if using any other engine. If the optional password is not
+proxy. The certificate must be PEM format. If the optional password is not
 specified, it is queried for on the terminal. Use --proxy-key to provide the
 private key.
 

docs/cmdline-opts/proxy.md

@@ -27,9 +27,9 @@ used. (Added in 7.21.7)
 Unix domain sockets are supported for socks proxy. Set localhost for the host
 part. e.g. socks5h://localhost/path/to/socket.sock
 
-HTTPS proxy support works with the https:// protocol prefix for OpenSSL
-and GnuTLS (added in 7.52.0). It also works for BearSSL, mbedTLS, Rustls,
-Schannel, Secure Transport and wolfSSL (added in 7.87.0).
+HTTPS proxy support works with the https:// protocol prefix for OpenSSL and
+GnuTLS (added in 7.52.0). It also works for BearSSL, mbedTLS, Rustls, Schannel
+and wolfSSL (added in 7.87.0).
 
 Unrecognized and unsupported proxy protocols cause an error (added in 7.52.0).
 Ancient curl versions ignored unknown schemes and used http:// instead.

docs/cmdline-opts/write-out.md

@@ -62,7 +62,7 @@ The variables available are:
 
 ## `certs`
 Output the certificate chain with details. Supported only by the OpenSSL,
-GnuTLS, Schannel, Rustls, and Secure Transport backends. (Added in 7.88.0)
+GnuTLS, Schannel and Rustls backends. (Added in 7.88.0)
 
 ## `conn_id`
 The connection identifier last used by the transfer. The connection id is
@@ -128,8 +128,7 @@ The http method used in the most recent HTTP request. (Added in 7.72.0)
 
 ## `num_certs`
 Number of server certificates received in the TLS handshake. Supported only by
-the OpenSSL, GnuTLS, Schannel, Rustls and Secure Transport backends.
-(Added in 7.88.0)
+the OpenSSL, GnuTLS, Schannel and Rustls backends. (Added in 7.88.0)
 
 ## `num_connects`
 Number of new connects made in the recent transfer. (Added in 7.12.3)