romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-27 23:53:06 +03:00
Code Issues Projects Releases Packages Wiki Activity

nss: load libnssckbi.so if no other trust is specified

Browse source 
The module contains a more comprehensive set of trust information than
supported by nss-pem, because libnssckbi.so also includes information
about distrusted certificates.

Reviewed-by: Kai Engert
Closes #1414
This commit is contained in:
Kamil Dudka 2017-04-10 17:40:30 +02:00
parent fab3d1ec65
commit e3e8d0204b
2 changed files with 48 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

5
docs/libcurl/opts/CURLOPT_CAINFO.3
View file

@ -40,6 +40,11 @@ is assumed to be stored, as established at build time.
If curl is built against the NSS SSL library, the NSS PEM PKCS#11 module
(libnsspem.so) needs to be available for this option to work properly.
Starting with curl-7.55.0, if both \fICURLOPT_CAINFO(3)\fP and
\fICURLOPT_CAPATH(3)\fP are unset, NSS-linked libcurl tries to load
libnssckbi.so, which contains a more comprehensive set of trust information
than supported by nss-pem, because libnssckbi.so also includes information
about distrusted certificates.
(iOS and macOS only) If curl is built against Secure Transport, then this
option is supported for backward compatibility with other SSL engines, but it