romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 05:23:32 +03:00
Code Issues Projects Releases Packages Wiki Activity

SSL: Add an option to disable certificate revocation checks

Browse source 
New tool option --ssl-no-revoke.
New value CURLSSLOPT_NO_REVOKE for CURLOPT_SSL_OPTIONS.

Currently this option applies only to WinSSL where we have automatic
certificate revocation checking by default. According to the
ssl-compared chart there are other backends that have automatic checking
(NSS, wolfSSL and DarwinSSL) so we could possibly accommodate them at
some later point.

Bug: https://github.com/bagder/curl/issues/264
Reported-by: zenden2k <zenden2k@gmail.com>
This commit is contained in:
Jay Satiro 2015-07-17 02:40:16 -04:00
parent 606b29fe0d
commit 172b2beba6
15 changed files with 129 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

14
docs/SSL-PROBLEMS
View file

@ -71,3 +71,17 @@ Allow BEAST
introduced. Exactly as it sounds, it re-introduces the BEAST vulnerability
but on the other hand it allows curl to connect to that kind of strange
servers.
Disabling certificate revocation checks
Some SSL backends may do certificate revocation checks (CRL, OCSP, etc)
depending on the OS or build configuration. The --ssl-no-revoke option was
introduced in 7.44.0 to disable revocation checking but currently is only
supported for WinSSL (the native Windows SSL library), with an exception in
the case of Windows' Untrusted Publishers blacklist which it seems can't be
bypassed. This option may have broader support to accommodate other SSL
backends in the future.
References:
http://curl.haxx.se/docs/ssl-compared.html

4
docs/curl.1
View file

@ -1545,6 +1545,10 @@ and TLS1.0 protocols known as BEAST. If this option isn't used, the SSL layer
may use workarounds known to cause interoperability problems with some older
SSL implementations. WARNING: this option loosens the SSL security, and by
using this flag you ask for exactly that. (Added in 7.25.0)
.IP "--ssl-no-revoke"
(WinSSL) This option tells curl to disable certificate revocation checks.
WARNING: this option loosens the SSL security, and by using this flag you ask
for exactly that. (Added in 7.44.0)
.IP "--socks4 <host[:port]>"
Use the specified SOCKS4 proxy. If the port number is not specified, it is
assumed at port 1080. (Added in 7.15.2)

26
docs/libcurl/opts/CURLOPT_SSL_OPTIONS.3
View file

@ -30,13 +30,25 @@ CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_OPTIONS, long bitmask);
.SH DESCRIPTION
Pass a long with a bitmask to tell libcurl about specific SSL behaviors.
\fICURLSSLOPT_ALLOW_BEAST\fP is the only supported bit and by setting this the
user will tell libcurl to not attempt to use any workarounds for a security
flaw in the SSL3 and TLS1.0 protocols. If this option isn't used or this bit
is set to 0, the SSL layer libcurl uses may use a work-around for this flaw
although it might cause interoperability problems with some (older) SSL
implementations. WARNING: avoiding this work-around lessens the security, and
by setting this option to 1 you ask for exactly that.
\fICURLSSLOPT_ALLOW_BEAST\fP tells libcurl to not attempt to use any
workarounds for a security flaw in the SSL3 and TLS1.0 protocols. If this
option isn't used or this bit is set to 0, the SSL layer libcurl uses may use a
work-around for this flaw although it might cause interoperability problems
with some (older) SSL implementations. WARNING: avoiding this work-around
lessens the security, and by setting this option to 1 you ask for exactly that.
This option is only supported for DarwinSSL, NSS and OpenSSL.
Added in 7.44.0:
\fICURLSSLOPT_NO_REVOKE\fP tells libcurl to disable certificate revocation
checks for those SSL backends where such behavior is present. \fBCurrently this
option is only supported for WinSSL (the native Windows SSL library), with an
exception in the case of Windows' Untrusted Publishers blacklist which it seems
can't be bypassed.\fP This option may have broader support to accommodate other
SSL backends in the future.
http://curl.haxx.se/docs/ssl-compared.html
.SH DEFAULT
0
.SH PROTOCOLS