4 ms·

Watch out. Does curl check the key chain against any key store? I bet not.

• lnguyen 14y ago
  Actually it does. You turn off checking via -k
  • somesay 14y ago
    Oh, nice, you are right, should be compiled against OS' key storage. Actually it's wget who often doesn't care of that.
    • lukeschlather 14y ago
      Wget has the --no-check-certificate flag, I've had to use it to work with self-signed certs before.
    • LukeShu 14y ago
      Um, GNU wget does check the key, and it requires the lengthy `--no-check-certificate` to disable it. Perhaps busybox wget doesn't check the key? But if you're using busybox, that's a whole other can of worms.
      • 0xbadcafebee 14y ago
        Wget does not validate certificates by default because there's no CA bundle provided with wget. It does check for /etc/ssl/cert.pem, but it doesn't provide one. So you have to provide one or set up /etc/ssl/certs/ as OpenSSL libraries expect. Curl does provide a CA bundle (/usr/share/curl/ca-bundle.crt) and by default libcurl validates certs against it.
        • halfasleep 14y ago
          cURL doesn't provide a CA bundle any more [1], it's the job of your OS to provide this. As I understand it, all tools that provide SSL support will fail safe if there are no root CAs on your system. [1] http://curl.haxx.se/docs/sslcerts.html http://curl.haxx.se/docs/sslcerts.html
          • LukeShu 14y ago
            Though, to be fair: $ pacman -Qi ca-certificates | grep 'Required By' Required By : ca-certificates-java curl glib-networking neon qca qt4 Note that curl is on that list but wget isn't.
            • 0xbadcafebee 14y ago
              Pacman lists ca-certificates as an optional requirement of wget: https://www.archlinux.org/packages/extra/x86_64/wget/ https://www.archlinux.org/packages/extra/x86_64/wget/ But the point halfasleep is making is important: Don't assume either wget or curl will validate your SSL connection because it may not have been set up by your OS/distribution.
              • somesay 14y ago
                I wasn't that wrong then. ;)
          • stock_toaster 14y ago
            They do still provide a bundle[1] though, for cases where you need it (eg homebrew's curl-ca-bundle package). [1]: http://curl.haxx.se/docs/caextract.html
    • somesay 14y ago
      Touché!
  • deleted 14y ago
    [deleted]
• comice 14y ago
  It does if you're on a proper operating system like Debian :)