romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-03 18:20:28 +03:00
Code Issues Projects Releases Packages Wiki Activity

SSL: Add an option to disable certificate revocation checks

Browse source 
New tool option --ssl-no-revoke.
New value CURLSSLOPT_NO_REVOKE for CURLOPT_SSL_OPTIONS.

Currently this option applies only to WinSSL where we have automatic
certificate revocation checking by default. According to the
ssl-compared chart there are other backends that have automatic checking
(NSS, wolfSSL and DarwinSSL) so we could possibly accommodate them at
some later point.

Bug: https://github.com/bagder/curl/issues/264
Reported-by: zenden2k <zenden2k@gmail.com>
This commit is contained in:
Jay Satiro 2015-07-17 02:40:16 -04:00
parent 606b29fe0d
commit 172b2beba6
15 changed files with 129 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

14
docs/SSL-PROBLEMS
View file

@ -71,3 +71,17 @@ Allow BEAST
introduced. Exactly as it sounds, it re-introduces the BEAST vulnerability
but on the other hand it allows curl to connect to that kind of strange
servers.
Disabling certificate revocation checks
Some SSL backends may do certificate revocation checks (CRL, OCSP, etc)
depending on the OS or build configuration. The --ssl-no-revoke option was
introduced in 7.44.0 to disable revocation checking but currently is only
supported for WinSSL (the native Windows SSL library), with an exception in
the case of Windows' Untrusted Publishers blacklist which it seems can't be
bypassed. This option may have broader support to accommodate other SSL
backends in the future.
References:
http://curl.haxx.se/docs/ssl-compared.html