eefcc1bda4
curldown is this new file format for libcurl man pages. It is markdown inspired with differences: - Each file has a set of leading headers with meta-data - Supports a small subset of markdown - Uses .md file extensions for editors/IDE/GitHub to treat them nicely - Generates man pages very similar to the previous ones - Generates man pages that still convert nicely to HTML on the website - Detects and highlights mentions of curl symbols automatically (when their man page section is specified) tools: - cd2nroff: converts from curldown to nroff man page - nroff2cd: convert an (old) nroff man page to curldown - cdall: convert many nroff pages to curldown versions - cd2cd: verifies and updates a curldown to latest curldown This setup generates .3 versions of all the curldown versions at build time. CI: Since the documentation is now technically markdown in the eyes of many things, the CI runs many more tests and checks on this documentation, including proselint, link checkers and tests that make sure we capitalize the first letter after a period... Closes #12730
83 lines
2.1 KiB
Markdown
83 lines
2.1 KiB
Markdown
---
|
|
c: Copyright (C) Daniel Stenberg, <daniel.se>, et al.
|
|
SPDX-License-Identifier: curl
|
|
Title: CURLOPT_CRLFILE
|
|
Section: 3
|
|
Source: libcurl
|
|
See-also:
|
|
- CURLOPT_PROXY_CRLFILE (3)
|
|
- CURLOPT_SSL_VERIFYHOST (3)
|
|
- CURLOPT_SSL_VERIFYPEER (3)
|
|
---
|
|
|
|
# NAME
|
|
|
|
CURLOPT_CRLFILE - Certificate Revocation List file
|
|
|
|
# SYNOPSIS
|
|
|
|
~~~c
|
|
#include <curl/curl.h>
|
|
|
|
CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CRLFILE, char *file);
|
|
~~~
|
|
|
|
# DESCRIPTION
|
|
|
|
Pass a char pointer to a null-terminated string naming a *file* with the
|
|
concatenation of CRL (in PEM format) to use in the certificate validation that
|
|
occurs during the SSL exchange.
|
|
|
|
When curl is built to use GnuTLS, there is no way to influence the use of CRL
|
|
passed to help in the verification process.
|
|
|
|
When libcurl is built with OpenSSL support, X509_V_FLAG_CRL_CHECK and
|
|
X509_V_FLAG_CRL_CHECK_ALL are both set, requiring CRL check against all the
|
|
elements of the certificate chain if a CRL file is passed. Also note that
|
|
CURLOPT_CRLFILE(3) implies **CURLSSLOPT_NO_PARTIALCHAIN** (see
|
|
CURLOPT_SSL_OPTIONS(3)) since curl 7.71.0 due to an OpenSSL bug.
|
|
|
|
This option makes sense only when used in combination with the
|
|
CURLOPT_SSL_VERIFYPEER(3) option.
|
|
|
|
A specific error code (*CURLE_SSL_CRL_BADFILE*) is defined with the option. It
|
|
is returned when the SSL exchange fails because the CRL file cannot be
|
|
loaded. A failure in certificate verification due to a revocation information
|
|
found in the CRL does not trigger this specific error.
|
|
|
|
The application does not have to keep the string around after setting this
|
|
option.
|
|
|
|
# DEFAULT
|
|
|
|
NULL
|
|
|
|
# PROTOCOLS
|
|
|
|
All TLS-based protocols
|
|
|
|
# EXAMPLE
|
|
|
|
~~~c
|
|
int main(void)
|
|
{
|
|
CURL *curl = curl_easy_init();
|
|
if(curl) {
|
|
CURLcode res;
|
|
curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
|
|
curl_easy_setopt(curl, CURLOPT_CRLFILE, "/etc/certs/crl.pem");
|
|
res = curl_easy_perform(curl);
|
|
curl_easy_cleanup(curl);
|
|
}
|
|
}
|
|
~~~
|
|
|
|
# AVAILABILITY
|
|
|
|
Added in 7.19.0
|
|
|
|
# RETURN VALUE
|
|
|
|
Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
|
|
CURLE_OUT_OF_MEMORY if there was insufficient heap space.
|