romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-04 18:26:13 +03:00
Code Issues Projects Releases Packages Wiki Activity

ssl: support Apple SecTrust configurations

Browse source 
- configure/cmake support for enabling the option
- supported in OpenSSL and GnuTLS backends
- when configured, Apple SecTrust is the default trust store
  for peer verification. When one of the CURLOPT_* for adding
  certificates is used, that default does not apply.
- add documentation of build options and SSL use

Closes #18703
This commit is contained in:
Stefan Eissing 2025-09-24 10:19:46 +02:00 • committed by Daniel Stenberg
parent 9cc1ee55a4
commit eefd03c572
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
29 changed files with 1377 additions and 604 deletions
Download patch file Download diff file Expand all files Collapse all files

14
lib/setopt.c
View file

@ -2206,6 +2206,7 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
/*
* Set CA info for SSL connection. Specify filename of the CA certificate
*/
s->ssl.custom_cafile = TRUE;
return Curl_setstropt(&s->str[STRING_SSL_CAFILE], ptr);
#ifndef CURL_DISABLE_PROXY
@ -2214,6 +2215,7 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
* Set CA info SSL connection for proxy. Specify filename of the
* CA certificate
*/
s->proxy_ssl.custom_cafile = TRUE;
return Curl_setstropt(&s->str[STRING_SSL_CAFILE_PROXY], ptr);
#endif
@ -2223,9 +2225,11 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
* certificates which have been prepared using openssl c_rehash utility.
*/
#ifdef USE_SSL
if(Curl_ssl_supports(data, SSLSUPP_CA_PATH))
if(Curl_ssl_supports(data, SSLSUPP_CA_PATH)) {
/* This does not work on Windows. */
s->ssl.custom_capath = TRUE;
return Curl_setstropt(&s->str[STRING_SSL_CAPATH], ptr);
}
#endif
return CURLE_NOT_BUILT_IN;
#ifndef CURL_DISABLE_PROXY
@ -2235,9 +2239,11 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
* CA certificates which have been prepared using openssl c_rehash utility.
*/
#ifdef USE_SSL
if(Curl_ssl_supports(data, SSLSUPP_CA_PATH))
if(Curl_ssl_supports(data, SSLSUPP_CA_PATH)) {
/* This does not work on Windows. */
s->proxy_ssl.custom_capath = TRUE;
return Curl_setstropt(&s->str[STRING_SSL_CAPATH_PROXY], ptr);
}
#endif
return CURLE_NOT_BUILT_IN;
#endif
@ -2900,8 +2906,10 @@ static CURLcode setopt_blob(struct Curl_easy *data, CURLoption option,
* Specify entire PEM of the CA certificate
*/
#ifdef USE_SSL
if(Curl_ssl_supports(data, SSLSUPP_CAINFO_BLOB))
if(Curl_ssl_supports(data, SSLSUPP_CAINFO_BLOB)) {
s->ssl.custom_cablob = TRUE;
return Curl_setblobopt(&s->blobs[BLOB_CAINFO], blob);
}
#endif
return CURLE_NOT_BUILT_IN;
case CURLOPT_ISSUERCERT_BLOB: