CA certificates need to be stored as individual PEM files in this directory. with-ca-path=PATH: use the specified path as CA certificate store. CA certificates need to be concatenated in PEM format into this file. with-ca-bundle=FILE: use the specified file as CA certificate store. The default CA certificate store can be changed at compile time with the following configure options: With the curl command line tool: -cacert Īdd the CA cert for your server to the existing default CA certificate store. For libcurl hackers: curl_easy_setopt(curl, CURLOPT_CAINFO, cacert) Get a CA certificate that can verify the remote server and use the proper option to point out this CA cert for verification when connecting. With the curl command line tool, you disable this with -k/-insecure. With libcurl you disable this with curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, FALSE) If the remote server uses a self-signed certificate, if you do not install a CA cert store, if the server uses a certificate signed by a CA that is not included in the store you use or if the remote host is an impostor impersonating your favorite site, and you want to transfer files from this server, do one of the following: If you communicate with HTTPS, FTPS or other TLS-using servers using certificates that are signed by CAs present in the store, you can be sure that the remote server really is the one it claims to be. This is done by using a CA certificate store that the SSL library can use to make sure the peer's server certificate is valid. Libcurl performs peer SSL certificate verification by default. You should just be aware that modern operating systems and browsers are setup to trust hundreds of companies and recent years several such CAs have been found untrustworthy. That is basically trust via someone else you trust.

Which CAs do you trust? You can decide to trust the same set of companies your operating system trusts, or the set one of the known browsers trust. they are signed by one of the CAs you trust.

In your local CA certificate store you have certs from trusted Certificate Authorities that you then can use to verify that the server certificates you see are valid.

If the version string says Schannel in it, then it was built with Schannel support. If you are not sure, then run 'curl -V' and read the results. Scroll down for details on how the OS-native engines handle SSL certificates. If libcurl was built with Schannel or Secure Transport support (the native SSL libraries included in Windows and Mac OS X), then this does not apply to you. CA extract SSL Certificate Verification SSL is TLS

Certificate is not yet valid