![]() ![]() If you communicate with HTTPS, FTPS or other TLS-using servers using certificates in the CA store, you can be sure that the remote server really is the one it claims to be. This is done by using a CA certificate store that the SSL library can use to make sure the peer's server certificate is valid. Libcurl performs peer SSL certificate verification by default. You should just be aware that modern operating systems and browsers are setup to trust hundreds of companies and in recent years several certificate authorities have been found untrustworthy. That is basically trust via someone else you trust. Which certificate authorities do you trust? You can decide to trust the same set of companies your operating system trusts, or the set one of the known browsers trust. They are signed by one of the certificate authorities you trust. In your local CA certificate store you have certs from trusted Certificate Authorities that you then can use to verify that the server certificates you see are valid. If the version string says Schannel in it, then it was built with Schannel support. If you are not sure, then run "curl -V" and read the results. Scroll down for details on how the OS-native engines handle SSL certificates. If libcurl was built with Schannel or Secure Transport support (the native SSL libraries included in Windows and Mac OS X), then this does not apply to you. ![]() CA extract SSL Certificate Verification SSL is TLS ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. Archives
December 2022
Categories |