/***************************************************************************
 *                                  _   _ ____  _
 *  Project                     ___| | | |  _ \| |
 *                             / __| | | | |_) | |
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
 * Copyright (C) 1998 - 2011, Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
 * are also available at http://curl.haxx.se/docs/copyright.html.
 *
 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
 * copies of the Software, and permit persons to whom the Software is
 * furnished to do so, under the terms of the COPYING file.
 *
 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
 * KIND, either express or implied.
 *
 ***************************************************************************/
#include <stdio.h>

#include <curl/curl.h>
#include <curl/types.h>
#include <curl/easy.h>

/* The idea behind the CURLOPT_CACERTSTORE option is when you want to
make sure the user is not tricked into root certificates that you don't
want him to trust or when you want to make sure that your program knows
that it is contacting the right website, your website.  So you want to
load the root certificates from a signed file which can't be tampered 
with by the user */

static const char rnd_seed[] = 
    "sdlsadlfjsad2wou3e923487u2r4lwjflsadfljasdfljsadfslakdjfsldj";
static void InitOpenSSL()
{
  OpenSSL_add_all_algorithms();
  SSL_load_error_strings();
  RAND_seed(rnd_seed, sizeof rnd_seed); /* or BN_generate_prime may fail */
}

static void* LoadCertStore( const char* file )
{
  X509_STORE* cert_store=X509_STORE_new();
  X509_STORE_set_default_paths(cert_store);
  X509_LOOKUP *lookup=X509_STORE_add_lookup(cert_store,X509_LOOKUP_file());
  if(lookup == NULL) goto err;
  /* Add code to Verify the signature on the file here this should not depend 
  on the certs inside the file or the user can just replace the file and 
  insert his own cert. You can replace this builtin function with your own
  function to load a signed pkcs7 file containing the certificates instead
  of a text pem file. */
  if( X509_LOOKUP_load_file(lookup,file,X509_FILETYPE_PEM) != 1)
    goto err;
  return cert_store;
err:
  X509_STORE_free( cert_store );
  return NULL;
}

int main(void)
{
  InitOpenSSL();
  /* the file normally passed to CURLOPT_CAFILE */
  void* certstore = LoadCertStore( "cacert.pem" );
  if( !certstore ){printf( "could not load cert store" );return 1;}
  CURL *curl;
  CURLcode res;

  curl_global_init(CURL_GLOBAL_DEFAULT);

  curl = curl_easy_init();
  if(curl) {
    /* what call to write: */
    curl_easy_setopt(curl, CURLOPT_URL, "https://www.langchat.com");
    curl_easy_setopt(curl, CURLOPT_CACERTSTORE, cert_store );
    res = curl_easy_perform(curl);
    /* always cleanup */
    curl_easy_cleanup(curl);
  }
  curl_global_cleanup();
  return 0;
}