Index: docs/curl.1 =================================================================== RCS file: /cvsroot/curl/curl/docs/curl.1,v retrieving revision 1.69 diff -c -r1.69 curl.1 *** docs/curl.1 7 May 2002 23:36:53 -0000 1.69 --- docs/curl.1 28 May 2002 08:24:16 -0000 *************** *** 211,217 **** If this option is used several times, the last one will be used. .IP "--cacert " (HTTPS) Tells curl to use the specified certificate file to verify the ! peer. The certificate must be in PEM format. If this option is used several times, the last one will be used. .IP "-f/--fail" --- 211,227 ---- If this option is used several times, the last one will be used. .IP "--cacert " (HTTPS) Tells curl to use the specified certificate file to verify the ! peer. The file may contain multiple CA certificates. The certificate(s) must ! be in PEM format. ! ! If this option is used several times, the last one will be used. ! .IP "--capath " ! (HTTPS) Tells curl to use the specified certificate directory to verify the ! peer. The certificates must be in PEM format, and the directory must have been ! processed using the c_rehash utility supplied with openssl. Certificate directories ! are not supported under Windows (because c_rehash uses symbolink links to ! create them). Using --capath can allow curl to make https connections much ! more efficiently than using --cacert if the --cacert file contains many CA certificates. If this option is used several times, the last one will be used. .IP "-f/--fail" Index: docs/libcurl/curl_easy_setopt.3 =================================================================== RCS file: /cvsroot/curl/curl/docs/libcurl/curl_easy_setopt.3,v retrieving revision 1.10 diff -c -r1.10 curl_easy_setopt.3 *** docs/libcurl/curl_easy_setopt.3 21 May 2002 22:20:16 -0000 1.10 --- docs/libcurl/curl_easy_setopt.3 28 May 2002 08:24:17 -0000 *************** *** 514,525 **** .B CURLOPT_SSL_VERIFYPEER Pass a long that is set to a non-zero value to make curl verify the peer's certificate. The certificate to verify against must be specified with the ! CURLOPT_CAINFO option. (Added in 7.4.2) .TP .B CURLOPT_CAINFO ! Pass a char * to a zero terminated file naming holding the certificate to ! verify the peer with. This only makes sense when used in combination with the ! CURLOPT_SSL_VERIFYPEER option. (Added in 7.4.2) .TP .B CURLOPT_PASSWDFUNCTION Pass a pointer to a \fIcurl_passwd_callback\fP function that will be called --- 514,533 ---- .B CURLOPT_SSL_VERIFYPEER Pass a long that is set to a non-zero value to make curl verify the peer's certificate. The certificate to verify against must be specified with the ! CURLOPT_CAINFO option (Added in 7.4.2) or a certificate directory must be specified ! with the CURLOPT_CAPATH option (Added in 7.9.8). .TP .B CURLOPT_CAINFO ! Pass a char * to a zero terminated string naming a file holding one or more ! certificates to verify the peer with. This only makes sense when used in ! combination with the CURLOPT_SSL_VERIFYPEER option. (Added in 7.4.2) ! .TP ! .B CURLOPT_CAPATH ! Pass a char * to a zero terminated string naming a directory holding multiple CA ! certificates to verify the peer with. The certificate directory must be prepared using ! the openssl c_rehash utility. This only makes sense when used in combination with the ! CURLOPT_SSL_VERIFYPEER option. The CAPATH function apparently does not work in Windows ! due to some limitation in openssl. (Added in 7.9.8) .TP .B CURLOPT_PASSWDFUNCTION Pass a pointer to a \fIcurl_passwd_callback\fP function that will be called Index: include/curl/curl.h =================================================================== RCS file: /cvsroot/curl/curl/include/curl/curl.h,v retrieving revision 1.147 diff -c -r1.147 curl.h *** include/curl/curl.h 21 May 2002 22:22:28 -0000 1.147 --- include/curl/curl.h 28 May 2002 08:24:17 -0000 *************** *** 544,549 **** --- 544,553 ---- /* mark this as start of a cookie session */ CINIT(COOKIESESSION, LONG, 96), + + /* The CApath directory used to validate the peer certificate + this option is used only if SSL_VERIFYPEER is true */ + CINIT(CAPATH, OBJECTPOINT, 97), CURLOPT_LASTENTRY /* the last unusued */ } CURLoption; Index: lib/url.c =================================================================== RCS file: /cvsroot/curl/curl/lib/url.c,v retrieving revision 1.209 diff -c -r1.209 url.c *** lib/url.c 21 May 2002 22:24:56 -0000 1.209 --- lib/url.c 28 May 2002 08:24:19 -0000 *************** *** 981,987 **** * Set CA info for SSL connection. Specify file name of the CA certificate */ data->set.ssl.CAfile = va_arg(param, char *); ! data->set.ssl.CApath = NULL; /*This does not work on windows.*/ break; case CURLOPT_TELNETOPTIONS: /* --- 981,993 ---- * Set CA info for SSL connection. Specify file name of the CA certificate */ data->set.ssl.CAfile = va_arg(param, char *); ! break; ! case CURLOPT_CAPATH: ! /* ! * Set CA path info for SSL connection. Specify directory name of the CA certificates ! * which have been prepared using openssl c_rehash utility. ! */ ! data->set.ssl.CApath = va_arg(param, char *); /*This does not work on windows.*/ break; case CURLOPT_TELNETOPTIONS: /* Index: src/main.c =================================================================== RCS file: /cvsroot/curl/curl/src/main.c,v retrieving revision 1.131 diff -c -r1.131 main.c *** src/main.c 21 May 2002 22:18:34 -0000 1.131 --- src/main.c 28 May 2002 08:24:21 -0000 *************** *** 345,350 **** --- 345,351 ---- " --pass Specifies your passphrase for the private key (HTTPS)"); puts(" --engine Specifies the crypto engine to use (HTTPS)\n" " --cacert CA certifciate to verify peer against (SSL)\n" + " --capath CA directory (made using c_rehash) to verify peer against (SSL, NOT Windows)\n" " --ciphers What SSL ciphers to use (SSL)\n" " --connect-timeout Maximum time allowed for connection\n" " -f/--fail Fail silently (no output at all) on errors (H)\n" *************** *** 454,459 **** --- 455,461 ---- char *cert; char *cert_type; char *cacert; + char *capath; char *key; char *key_type; char *key_passwd; *************** *** 999,1004 **** --- 1001,1007 ---- {"Ed","key-type", TRUE}, {"Ee","pass", TRUE}, {"Ef","engine", TRUE}, + {"Eg","capath ", TRUE}, {"f", "fail", FALSE}, {"F", "form", TRUE}, {"g", "globoff", FALSE}, *************** *** 1335,1340 **** --- 1338,1347 ---- case 'f': /* crypto engine */ GetStr(&config->engine, nextarg); break; + case 'g': /* CA info PEM file */ + /* CA cert directory */ + GetStr(&config->capath, nextarg); + break; default: /* certificate file */ { char *ptr = strchr(nextarg, ':'); *************** *** 2082,2087 **** --- 2089,2096 ---- curl_formfree(config->httppost); if(config->cacert) free(config->cacert); + if(config->capath) + free(config->capath); if(config->cookiejar) free(config->cookiejar); *************** *** 2558,2565 **** curl_easy_setopt(curl, CURLOPT_SSLKEYTYPE, config->key_type); curl_easy_setopt(curl, CURLOPT_SSLKEYPASSWD, config->key_passwd); ! if(config->cacert) { ! curl_easy_setopt(curl, CURLOPT_CAINFO, config->cacert); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, TRUE); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2); } --- 2567,2575 ---- curl_easy_setopt(curl, CURLOPT_SSLKEYTYPE, config->key_type); curl_easy_setopt(curl, CURLOPT_SSLKEYPASSWD, config->key_passwd); ! if(config->cacert || config->capath) { ! if (config->cacert) curl_easy_setopt(curl, CURLOPT_CAINFO, config->cacert); ! if (config->capath) curl_easy_setopt(curl, CURLOPT_CAPATH, config->capath); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, TRUE); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2); }