3 ms·
Presumably apple are setting this[0]? Emphasis mine. CURLSSLOPT_NATIVE_CA Tell libcurl to use the operating system's native CA store for certificate verif
by d-z-m 3y ago
Presumably apple are setting this[0]? Emphasis mine.
CURLSSLOPT_NATIVE_CA
Tell libcurl to use the operating system's native CA store for certificate verification. If you set this option and *also set a CA certificate file* or directory then during verification those certificates are searched in addition to the native CA store.
It seems as though if the --cacert and this option are combined, libcurl tries to honor both of them. Perhaps they should be mutually exclusive?
- ibotty 3y agoNo, that's not the case. `curl` the binary knows how to call `libcurl` the library.
- d-z-m 3y agoRight. I'm more suggesting that this combination of options should be handled differently inside of libcurl. E.g. either you want the native store for validation, or you don't. If you "also set a CA certificate file" as per the libcurl docs, presumably you want to use that cert only, and no others. I'm not too familiar with how the library works internally, but I was imagining something like the above would be possible.
- deanishe 3y agoIt isn't (lib)curl that's doing this, it's Apple's own version of LibreSSL that curl is built against on macOS. There's nothing curl can do about it.