From c46a7913e537381313a9a31e609530280379cb0b Mon Sep 17 00:00:00 2001
From: Viktor Szakats <commit@vsz.me>
Date: Fri, 15 May 2026 14:33:07 +0200
Subject: [PATCH] setopt: fix to honor `CURLOPT_PROXY_CAINFO_BLOB` over Native
 CA

In AppleSecTrust or NativeCA-enabled builds, make sure override it when
setting a custom `CURLOPT_PROXY_CAINFO_BLOB`.

Reported-by: Joshua Rogers (Aisle Research)

Follow-up to 1730407b74f41cfd33f189348be54d0504b7c291 #18279
Follow-up to eefd03c572996e5de4dec4fe295ad6f103e0eefc #18703

Closes #21631
---
 lib/setopt.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/setopt.c b/lib/setopt.c
index 2bc49868b8..5a3e02c76f 100644
--- a/lib/setopt.c
+++ b/lib/setopt.c
@@ -2842,8 +2842,10 @@ static CURLcode setopt_blob(struct Curl_easy *data, CURLoption option,
      * Specify entire PEM of the CA certificate
      */
 #ifdef USE_SSL
-    if(Curl_ssl_supports(data, SSLSUPP_CAINFO_BLOB))
+    if(Curl_ssl_supports(data, SSLSUPP_CAINFO_BLOB)) {
+      s->proxy_ssl.custom_cablob = TRUE;
       return Curl_setblobopt(&s->blobs[BLOB_CAINFO_PROXY], blob);
+    }
 #endif
     return CURLE_NOT_BUILT_IN;
   case CURLOPT_PROXY_ISSUERCERT_BLOB: