TLS: remove support for Secure Transport and BearSSL

These libraries do not support TLS 1.3 and have been marked for removal
for over a year. We want to help users select a TLS dependency that is
future-proof and reliable, and not supporting TLS 1.3 in 2025 does not
infer confidence. Users who build libcurl are likely to be served better
and get something more future-proof with a TLS library that supports
1.3.

Closes #16677

docs/libcurl/curl_easy_ssls_export.md

@@ -13,7 +13,6 @@ Protocol:
 TLS-backend:
   - GnuTLS
   - OpenSSL
-  - BearSSL
   - wolfSSL
   - mbedTLS
 Added-in: 8.12.0

docs/libcurl/curl_easy_ssls_import.md

@@ -13,7 +13,6 @@ Protocol:
 TLS-backend:
   - GnuTLS
   - OpenSSL
-  - BearSSL
   - wolfSSL
   - mbedTLS
 Added-in: 8.12.0

docs/libcurl/curl_global_sslset.md

@@ -66,15 +66,15 @@ This does not just mean no other thread that is using libcurl.
 
 # Names
 
-SSL backend names (case-insensitive): BearSSL, GnuTLS, mbedTLS, OpenSSL,
-Rustls, Schannel, Secure-Transport, wolfSSL
+SSL backend names (case-insensitive): GnuTLS, mbedTLS, OpenSSL, Rustls,
+Schannel, wolfSSL
 
 The name "OpenSSL" is used for all versions of OpenSSL and its associated
 forks/flavors in this function. OpenSSL, BoringSSL, LibreSSL, quictls and
-AmiSSL are all supported by libcurl, but in the eyes of
-curl_global_sslset(3) they are all just "OpenSSL". They all mostly
-provide the same API. curl_version_info(3) can return more specific info about
-the exact OpenSSL flavor and version number in use.
+AmiSSL are all supported by libcurl, but in the eyes of curl_global_sslset(3)
+they are all just "OpenSSL". They all mostly provide the same API.
+curl_version_info(3) can return more specific info about the exact OpenSSL
+flavor and version number in use.
 
 # struct
 
@@ -93,11 +93,11 @@ typedef enum {
   CURLSSLBACKEND_POLARSSL = 6, /* deprecated */
   CURLSSLBACKEND_WOLFSSL = 7,
   CURLSSLBACKEND_SCHANNEL = 8,
-  CURLSSLBACKEND_SECURETRANSPORT = 9,
+  CURLSSLBACKEND_SECURETRANSPORT = 9, /* deprecated */
   CURLSSLBACKEND_AXTLS = 10, /* deprecated */
   CURLSSLBACKEND_MBEDTLS = 11,
   CURLSSLBACKEND_MESALINK = 12, /* deprecated */
-  CURLSSLBACKEND_BEARSSL = 13,
+  CURLSSLBACKEND_BEARSSL = 13, /* deprecated */
   CURLSSLBACKEND_RUSTLS = 14
 } curl_sslbackend;
 ~~~

docs/libcurl/libcurl-env.md

@@ -51,8 +51,8 @@ backend at first use. If no selection is done by the program using libcurl,
 this variable's selection is used. Setting a name that is not a built-in
 alternative makes libcurl stay with the default.
 
-SSL backend names (case-insensitive): BearSSL, GnuTLS, mbedTLS, OpenSSL,
-Rustls, Schannel, Secure-Transport, wolfSSL
+SSL backend names (case-insensitive): GnuTLS, mbedTLS, OpenSSL, Rustls,
+Schannel, wolfSSL
 
 ## `HOME`
 

docs/libcurl/opts/CURLINFO_CERTINFO.md

@@ -14,7 +14,6 @@ TLS-backend:
   - OpenSSL
   - GnuTLS
   - Schannel
-  - Secure Transport
   - rustls
 Added-in: 7.19.1
 ---
@@ -97,8 +96,8 @@ See also the *certinfo.c* example.
 
 # HISTORY
 
-GnuTLS support added in 7.42.0. Schannel support added in 7.50.0. Secure
-Transport support added in 7.79.0. mbedTLS support added in 8.9.0.
+GnuTLS support added in 7.42.0. Schannel support added in 7.50.0. mbedTLS
+support added in 8.9.0.
 
 # %AVAILABILITY%
 

docs/libcurl/opts/CURLINFO_TLS_SSL_PTR.md

@@ -11,12 +11,10 @@ See-also:
 Protocol:
   - TLS
 TLS-backend:
-  - BearSSL
   - GnuTLS
   - mbedTLS
   - OpenSSL
   - Schannel
-  - Secure Transport
   - wolfSSL
 Added-in: 7.48.0
 ---
@@ -87,10 +85,6 @@ as well:
 
 **CtxtHandle ***
 
-## Secure Transport
-
-**SSLContext ***
-
 ## wolfSSL
 
 **SSL ***

docs/libcurl/opts/CURLOPT_ALTSVC_CTRL.md

@@ -35,10 +35,10 @@ CURLcode curl_easy_setopt(CURL *handle, CURLOPT_ALTSVC_CTRL, long bitmask);
 Populate the long *bitmask* with the correct set of features to instruct
 libcurl how to handle Alt-Svc for the transfers using this handle.
 
-libcurl only accepts Alt-Svc headers over a Secure Transport, meaning
-HTTPS. It also only completes a request to an alternative origin if that
-origin is properly hosted over HTTPS. These requirements are there to make
-sure both the source and the destination are legitimate.
+libcurl only accepts Alt-Svc headers over HTTPS. It also only completes a
+request to an alternative origin if that origin is properly hosted over HTTPS.
+These requirements are there to make sure both the source and the destination
+are legitimate.
 
 Alternative services are only used when setting up new connections. If there
 exists an existing connection to the host in the connection pool, then that is

docs/libcurl/opts/CURLOPT_CAINFO.md

@@ -42,10 +42,6 @@ accessible file.
 This option is by default set to the system path where libcurl's CA
 certificate bundle is assumed to be stored, as established at build time.
 
-(iOS and macOS) When curl uses Secure Transport this option is supported. If
-the option is not set, then curl uses the certificates in the system and user
-Keychain to verify the peer.
-
 (Schannel) This option is supported for Schannel in Windows 7 or later but we
 recommend not using it until Windows 8 since it works better starting then.
 If the option is not set, then curl uses the certificates in the Windows'
@@ -61,8 +57,8 @@ The default value for this can be figured out with CURLINFO_CAINFO(3).
 
 # DEFAULT
 
-Built-in system specific. When curl is built with Secure Transport or
-Schannel, this option is not set by default.
+Built-in system specific. When curl is built with Schannel, this option is not
+set by default.
 
 # %PROTOCOLS%
 

docs/libcurl/opts/CURLOPT_CAINFO_BLOB.md

@@ -12,12 +12,10 @@ See-also:
   - CURLOPT_SSL_VERIFYHOST (3)
   - CURLOPT_SSL_VERIFYPEER (3)
 TLS-backend:
-  - BearSSL
   - OpenSSL
   - mbedTLS
   - rustls
   - wolfSSL
-  - Secure Transport
   - Schannel
 Added-in: 7.77.0
 ---
@@ -81,9 +79,8 @@ int main(void)
 
 # HISTORY
 
-This option is supported by the BearSSL (since 7.79.0), mbedTLS (since
-7.81.0), Rustls (since 7.82.0), wolfSSL (since 8.2.0), OpenSSL, Secure
-Transport and Schannel backends.
+This option is supported by the mbedTLS (since 7.81.0), Rustls (since 7.82.0),
+wolfSSL (since 8.2.0), OpenSSL and Schannel backends.
 
 # %AVAILABILITY%
 

docs/libcurl/opts/CURLOPT_CERTINFO.md

@@ -16,7 +16,6 @@ TLS-backend:
   - OpenSSL
   - GnuTLS
   - Schannel
-  - Secure Transport
   - rustls
 Added-in: 7.19.1
 ---
@@ -88,8 +87,7 @@ int main(void)
 
 # HISTORY
 
-Schannel support added in 7.50.0. Secure Transport support added in 7.79.0.
-mbedTLS support added in 8.9.0.
+Schannel support added in 7.50.0. mbedTLS support added in 8.9.0.
 
 # %AVAILABILITY%
 

docs/libcurl/opts/CURLOPT_PINNEDPUBLICKEY.md

@@ -16,7 +16,6 @@ TLS-backend:
   - GnuTLS
   - wolfSSL
   - mbedTLS
-  - Secure Transport
   - Schannel
 Added-in: 7.39.0
 ---
@@ -129,8 +128,6 @@ footer:
 
 7.47.0: mbedTLS
 
-7.54.1: Secure Transport on macOS 10.7+/iOS 10+
-
 7.58.1: Schannel
 
 ## sha256 support
@@ -139,8 +136,6 @@ footer:
 
 7.47.0: mbedTLS
 
-7.54.1: Secure Transport on macOS 10.7+/iOS 10+
-
 7.58.1: Schannel
 
 Other SSL backends not supported.

docs/libcurl/opts/CURLOPT_PROXY.md

@@ -53,9 +53,8 @@ HTTP Proxy. Default when no scheme or proxy type is specified.
 
 ## https://
 
-HTTPS Proxy. (Added in 7.52.0 for OpenSSL and GnuTLS Since 7.87.0, it
-also works for BearSSL, mbedTLS, Rustls, Schannel, Secure Transport and
-wolfSSL.)
+HTTPS Proxy. (Added in 7.52.0 for OpenSSL and GnuTLS Since 7.87.0, it also
+works for mbedTLS, Rustls, Schannel and wolfSSL.)
 
 This uses HTTP/1 by default. Setting CURLOPT_PROXYTYPE(3) to
 **CURLPROXY_HTTPS2** allows libcurl to negotiate using HTTP/2 with proxy.

docs/libcurl/opts/CURLOPT_PROXYTYPE.md

@@ -35,8 +35,7 @@ HTTP Proxy. Default.
 ## CURLPROXY_HTTPS
 
 HTTPS Proxy using HTTP/1. (Added in 7.52.0 for OpenSSL and GnuTLS. Since
-7.87.0, it also works for BearSSL, mbedTLS, Rustls, Schannel, Secure Transport
-and wolfSSL.)
+7.87.0, it also works for mbedTLS, Rustls, Schannel and wolfSSL.)
 
 ## CURLPROXY_HTTPS2
 

docs/libcurl/opts/CURLOPT_PROXY_CAINFO.md

@@ -47,12 +47,6 @@ accessible file.
 This option is by default set to the system path where libcurl's CA
 certificate bundle is assumed to be stored, as established at build time.
 
-(iOS and macOS only) If curl is built against Secure Transport, then this
-option is supported for backward compatibility with other SSL engines, but it
-should not be set. If the option is not set, then curl uses the certificates
-in the system and user Keychain to verify the peer, which is the preferred
-method of verifying the peer's certificate chain.
-
 The application does not have to keep the string around after setting this
 option.
 

docs/libcurl/opts/CURLOPT_PROXY_CAINFO_BLOB.md

@@ -19,7 +19,6 @@ Protocol:
 TLS-backend:
   - OpenSSL
   - rustls
-  - Secure Transport
   - Schannel
 Added-in: 7.77.0
 ---

docs/libcurl/opts/CURLOPT_PROXY_SSLCERT.md

@@ -15,7 +15,6 @@ TLS-backend:
   - GnuTLS
   - mbedTLS
   - Schannel
-  - Secure Transport
   - wolfSSL
 Added-in: 7.52.0
 ---
@@ -38,13 +37,8 @@ This option is for connecting to an HTTPS proxy, not an HTTPS server.
 
 Pass a pointer to a null-terminated string as parameter. The string should be
 the filename of your client certificate used to connect to the HTTPS proxy.
-The default format is "P12" on Secure Transport and "PEM" on other engines,
-and can be changed with CURLOPT_PROXY_SSLCERTTYPE(3).
-
-With Secure Transport, this can also be the nickname of the certificate you
-wish to authenticate with as it is named in the security database. If you want
-to use a file from the current directory, please precede it with "./" prefix,
-in order to avoid confusion with a nickname.
+The default format "PEM", and can be changed with
+CURLOPT_PROXY_SSLCERTTYPE(3).
 
 When using a client certificate, you most likely also need to provide a
 private key with CURLOPT_PROXY_SSLKEY(3).

docs/libcurl/opts/CURLOPT_PROXY_SSLCERTTYPE.md

@@ -15,7 +15,6 @@ TLS-backend:
   - GnuTLS
   - mbedTLS
   - Schannel
-  - Secure Transport
   - wolfSSL
 Added-in: 7.52.0
 ---
@@ -37,10 +36,8 @@ CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_SSLCERTTYPE, char *type);
 Pass a pointer to a null-terminated string as parameter. The string should be
 the format of your client certificate used when connecting to an HTTPS proxy.
 
-Supported formats are "PEM" and "DER", except with Secure Transport or
-Schannel. OpenSSL (versions 0.9.3 and later), Secure Transport (on iOS 5 or
-later, or macOS 10.7 or later) and Schannel support "P12" for PKCS#12-encoded
-files.
+Supported formats are "PEM" and "DER", except with Schannel. OpenSSL and
+Schannel support "P12" for PKCS#12-encoded files.
 
 The application does not have to keep the string around after setting this
 option.

docs/libcurl/opts/CURLOPT_PROXY_SSLCERT_BLOB.md

@@ -14,7 +14,6 @@ Protocol:
 TLS-backend:
   - OpenSSL
   - Schannel
-  - Secure Transport
 Added-in: 7.71.0
 ---
 
@@ -35,9 +34,9 @@ CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_SSLCERT_BLOB,
 
 Pass a pointer to a curl_blob structure, which contains information (pointer
 and size) about a memory block with binary data of the certificate used to
-connect to the HTTPS proxy. The format must be "P12" on Secure Transport or
-Schannel. The format must be "P12" or "PEM" on OpenSSL. The string "P12" or
-"PEM" must be specified with CURLOPT_PROXY_SSLCERTTYPE(3).
+connect to the HTTPS proxy. The format must be "P12" on Schannel. The format
+must be "P12" or "PEM" on OpenSSL. The string "P12" or "PEM" must be specified
+with CURLOPT_PROXY_SSLCERTTYPE(3).
 
 If the blob is initialized with the flags member of struct curl_blob set to
 CURL_BLOB_COPY, the application does not have to keep the buffer around after

docs/libcurl/opts/CURLOPT_PROXY_SSLKEY.md

@@ -39,9 +39,9 @@ the filename of your private key used for connecting to the HTTPS proxy. The
 default format is "PEM" and can be changed with
 CURLOPT_PROXY_SSLKEYTYPE(3).
 
-(Windows, iOS and macOS) This option is ignored by Secure Transport and
-Schannel SSL backends because they expect the private key to be already
-present in the key chain or PKCS#12 file containing the certificate.
+This option is ignored by the Schannel backend because it expects the private
+key to be already present in the key chain or PKCS#12 file containing the
+certificate.
 
 The application does not have to keep the string around after setting this
 option.

docs/libcurl/opts/CURLOPT_PROXY_SSLKEYTYPE.md

@@ -12,7 +12,6 @@ Protocol:
   - TLS
 TLS-backend:
   - OpenSSL
-  - BearSSL
   - wolfSSL
 Added-in: 7.52.0
 ---

docs/libcurl/opts/CURLOPT_PROXY_SSL_CIPHER_LIST.md

@@ -14,9 +14,7 @@ Protocol:
   - TLS
 TLS-backend:
   - OpenSSL
-  - BearSSL
   - Schannel
-  - Secure Transport
   - wolfSSL
   - mbedTLS
   - rustls
@@ -92,7 +90,7 @@ int main(void)
 # HISTORY
 
 OpenSSL support added in 7.52.0.
-wolfSSL, Schannel, Secure Transport, and BearSSL support added in 7.87.0
+wolfSSL, Schannel support added in 7.87.0
 mbedTLS support added in 8.8.0.
 Rustls support added in 8.10.0.
 

docs/libcurl/opts/CURLOPT_SSLCERT.md

@@ -15,7 +15,6 @@ TLS-backend:
   - GnuTLS
   - mbedTLS
   - Schannel
-  - Secure Transport
   - wolfSSL
 Added-in: 7.1
 ---
@@ -35,16 +34,10 @@ CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSLCERT, char *cert);
 # DESCRIPTION
 
 Pass a pointer to a null-terminated string as parameter. The string should be
-the filename of your client certificate. The default format is `P12` on Secure
-Transport and `PEM` on other engines, and can be changed with
-CURLOPT_SSLCERTTYPE(3).
+the filename of your client certificate. The default format is `PEM` but can
+be changed with CURLOPT_SSLCERTTYPE(3).
 
-With Secure Transport, this can also be the nickname of the certificate you
-wish to authenticate with as it is named in the security database. If you want
-to use a file from the current directory, please precede it with `./` prefix,
-in order to avoid confusion with a nickname.
-
-(Schannel only) Client certificates can be specified by a path expression to a
+(Schannel) Client certificates can be specified by a path expression to a
 certificate store. (You can import *PFX* to a store first). You can use
 "\<store location\>\\\<store name\>\\\<thumbprint\>" to refer to a certificate
 in the system certificates store, for example,

docs/libcurl/opts/CURLOPT_SSLCERTTYPE.md

@@ -14,7 +14,6 @@ TLS-backend:
   - GnuTLS
   - mbedTLS
   - Schannel
-  - Secure Transport
   - wolfSSL
 Added-in: 7.9.3
 ---
@@ -36,10 +35,9 @@ CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSLCERTTYPE, char *type);
 Pass a pointer to a null-terminated string as parameter. The string should be
 the format of your certificate.
 
-Supported formats are "PEM" and "DER", except with Secure Transport or
-Schannel. OpenSSL (versions 0.9.3 and later), Secure Transport (on iOS 5 or
-later, or macOS 10.7 or later) and Schannel support "P12" for PKCS#12-encoded
-files. GnuTLS supports P12 starting with curl 8.11.0.
+Supported formats are "PEM" and "DER", except with Schannel. OpenSSL and
+Schannel support "P12" for PKCS#12-encoded files. GnuTLS supports P12 starting
+with curl 8.11.0.
 
 The application does not have to keep the string around after setting this
 option.

docs/libcurl/opts/CURLOPT_SSLCERT_BLOB.md

@@ -12,7 +12,6 @@ Protocol:
   - TLS
 TLS-backend:
   - OpenSSL
-  - Secure Transport
   - Schannel
   - mbedTLS
   - wolfSSL
@@ -35,10 +34,9 @@ CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSLCERT_BLOB,
 # DESCRIPTION
 
 Pass a pointer to a curl_blob structure, which contains (pointer and size) a
-client certificate. The format must be "P12" on Secure Transport or
-Schannel. The format must be "P12" or "PEM" on OpenSSL. The format must be
-"DER" or "PEM" on mbedTLS. The format must be specified with
-CURLOPT_SSLCERTTYPE(3).
+client certificate. The format must be "P12" on Schannel. The format must be
+"P12" or "PEM" on OpenSSL. The format must be "DER" or "PEM" on mbedTLS. The
+format must be specified with CURLOPT_SSLCERTTYPE(3).
 
 If the blob is initialized with the flags member of struct curl_blob set to
 CURL_BLOB_COPY, the application does not have to keep the buffer around after

docs/libcurl/opts/CURLOPT_SSLKEY.md

@@ -36,9 +36,9 @@ Pass a pointer to a null-terminated string as parameter. The string should be
 the filename of your private key. The default format is "PEM" and can be
 changed with CURLOPT_SSLKEYTYPE(3).
 
-(Windows, iOS and macOS) This option is ignored by Secure Transport and
-Schannel SSL backends because they expect the private key to be already present
-in the key-chain or PKCS#12 file containing the certificate.
+(Windows) This option is ignored by the Schannel SSL backend because it
+expects the private key to be already present in the key-chain or PKCS#12 file
+containing the certificate.
 
 The application does not have to keep the string around after setting this
 option.

docs/libcurl/opts/CURLOPT_SSLKEYTYPE.md

@@ -12,7 +12,6 @@ Protocol:
   - TLS
 TLS-backend:
   - OpenSSL
-  - BearSSL
   - wolfSSL
 Added-in: 7.9.3
 ---

docs/libcurl/opts/CURLOPT_SSL_CIPHER_LIST.md

@@ -14,9 +14,7 @@ Protocol:
   - TLS
 TLS-backend:
   - OpenSSL
-  - BearSSL
   - Schannel
-  - Secure Transport
   - wolfSSL
   - mbedTLS
   - rustls
@@ -98,8 +96,6 @@ int main(void)
 OpenSSL support added in 7.9.
 wolfSSL support added in 7.53.0.
 Schannel support added in 7.61.0.
-Secure Transport support added in 7.77.0.
-BearSSL support added in 7.83.0.
 mbedTLS support added in 8.8.0.
 Rustls support added in 8.10.0.
 

docs/libcurl/opts/CURLOPT_SSL_CTX_DATA.md

@@ -13,7 +13,6 @@ TLS-backend:
   - OpenSSL
   - wolfSSL
   - mbedTLS
-  - BearSSL
 Added-in: 7.10.6
 ---
 
@@ -118,8 +117,7 @@ int main(void)
 
 # HISTORY
 
-Added in 7.11.0 for OpenSSL, in 7.42.0 for wolfSSL, in 7.54.0 for mbedTLS,
-in 7.83.0 in BearSSL.
+Added in 7.11.0 for OpenSSL, in 7.42.0 for wolfSSL, in 7.54.0 for mbedTLS.
 
 # %AVAILABILITY%
 

docs/libcurl/opts/CURLOPT_SSL_CTX_FUNCTION.md

@@ -17,7 +17,6 @@ TLS-backend:
   - OpenSSL
   - wolfSSL
   - mbedTLS
-  - BearSSL
 Added-in: 7.10.6
 ---
 
@@ -46,10 +45,10 @@ of an SSL connection after having processed all other SSL related options to
 give a last chance to an application to modify the behavior of the SSL
 initialization. The *ssl_ctx* parameter is a pointer to the SSL library's
 *SSL_CTX* for OpenSSL or wolfSSL, a pointer to *mbedtls_ssl_config* for
-mbedTLS or a pointer to *br_ssl_client_context* for BearSSL. If an error is
-returned from the callback no attempt to establish a connection is made and
-the perform operation returns the callback's error code. Set the *clientp*
-argument passed in to this callback with the CURLOPT_SSL_CTX_DATA(3) option.
+mbedTLS. If an error is returned from the callback no attempt to establish a
+connection is made and the perform operation returns the callback's error
+code. Set the *clientp* argument passed in to this callback with the
+CURLOPT_SSL_CTX_DATA(3) option.
 
 This function gets called for all new connections made to a server, during the
 SSL negotiation. While *ssl_ctx* points to a newly initialized object each

docs/libcurl/opts/CURLOPT_SSL_FALSESTART.md

@@ -9,7 +9,7 @@ See-also:
 Protocol:
   - TLS
 TLS-backend:
-  - Secure Transport
+  - none
 Added-in: 7.42.0
 ---
 

docs/libcurl/opts/CURLOPT_SSL_VERIFYHOST.md

@@ -73,14 +73,6 @@ A certificate can be set for a numerical IP address (IPv4 or IPv6), but then
 it should be a Subject Alternate Name kind and its type should correctly
 identify the field as an IP address.
 
-# LIMITATIONS
-
-Secure Transport: If *verify* value is 0, then SNI is also disabled. SNI is a
-TLS extension that sends the hostname to the server. The server may use that
-information to do such things as sending back a specific certificate for the
-hostname, or forwarding the request to a specific origin server. Some
-hostnames may be inaccessible if SNI is not sent.
-
 # DEFAULT
 
 2