ssl: support Apple SecTrust configurations#18703
Conversation
icing
commented
Sep 24, 2025
icing
commented
- configure/cmake support for enabling the option
- supported in OpenSSL and GnuTLS backends
- when configured, Apple SecTrust is the default trust store for peer verification. When one of the CURLOPT_* for adding certificates is used, that default does not apply.
- add documentation of build options and SSL use
icing
added
TLS
appleOS
|
This is my suggestion on how to add this feature. We could maybe extend this to mbedTLS and wolfSSL, but I was not sure it is worth it. OpenSSL(-like)+GnuTLS should be enough for the start. The specific behaviour I designed for is: # uses Apple SecTrust
> curl https://example.com
# uses *only* certs from file.pem
> curl --cacert file.pem https://example.com
# uses *both* certs from file.pem and SecTrust
> curl --ca-native --cacert file.pem https://example.comThis would also happen for a # still uses Apple SecTrust
> curl --no-ca-native https://example.combecause I could not think of a way to decide if |
That's right it only disables the option which disables passing the flag. |
|
I don't know enough Apple to formally review this so I'm going to have to punt. I did take a look at it and left some comments though. |
icing
force-pushed
the
apple-sectrust
branch
2 times, most recently
from
3efe2dc to
ab78e43
Compare
|
Hm, this gets some new CI failures we need to check first |
- configure/cmake support for enabling the option - supported in OpenSSL and GnuTLS backends - when configured, Apple SecTrust is the default trust store for peer verification. When one of the CURLOPT_* for adding certificates is used, that default does not apply. - add documentation of build options and SSL use
- re-add backend Schannel check to not apply default BUNDLE/PATH - fix wording/formatting in SSLCERTS.md - clarify fallback option in INSTALL.md
There was a problem hiding this comment.
One minor, likely unrelated, log issue I noticed while testing, is that --doh-url seems to suppress the SSL Trust Anchors: info.
Using the -DUSE_APPLE_SECTRUST=ON dev build curl-macos-universal-clang from https://github.com/curl/curl-for-win/actions/runs/18216661900
$ CURL_CA_BUNDLE=/opt/homebrew/etc/ca-certificates/cert.pem ./curl -q --doh-url https://zero.dns0.eu/ -v https://curl.se/ --out-null
it does only say SSL certificate verified via OpenSSL..
With --doh-url <url> deleted, SSL Trust Anchors: appears as expected.
|
Good catch, @vszakats . I need to inspect the DoH code on how it tries to set ca-bundle/-path/native from the initiating transfer. Update: but when you explicity specify a CA-Bundle, as command line options or via env var, the native CA is turned off. You need to add |
Follow-up to 692c7f1 curl#19252 Follow-up to eefd03c curl#18703 Fixes curl#19724
With the same semantics as Apple SecTrust, in both libcurl and the curl tool, when using non-Schannel TLS backends. In practice it means that it makes TLS work without manually or implicitly configuring a CA bundle `.crt` file, such as `curl-ca-bundle.crt`. To enable: - autotools: `--enable-ca-native` - cmake: `-DCURL_CA_NATIVE=ON` - CPPFLAGS: `-DCURL_CA_NATIVE` When enabled: - enables `CURLSSLOPT_NATIVE_CA` (libcurl) / `--ca-native` and `--proxy-ca-native` (curl tool) options by default. - unsafe search for an on-disk CA bundle gets disabled by default. Equivalent to `--disable-ca-search` with autotools, `-DCURL_DISABLE_CA_SEARCH=ON` with CMake. - build-time detection of CA bundle and CA path gets disabled. As with Apple SecTrust. This was already the default for Windows. - native CA can be disabled at run-time with the `--no-ca-native` and/or `--no-proxy-ca-native` command-line options. Rationale: This build option: - has a repeat and active interest from packagers and users. - helps integrating curl with Windows for those who need this. - it also applies to macOS: #17525 Shipped in curl 8.17.0. - makes it trivial to use custom certs configured on the OS. - frees applications/packagers/users from the task of securely distributing, and keeping up-to-date, a CA bundle. - frees potentially many curl tool from configuring a CA bundle manually to access HTTPS (and other TLS) URLs. This is traditionally difficult on Windows because there is no concept of a universal, protected, non-world-writable, location on the file system to securely store a CA bundle. - allows using modern features regardless of Windows version. Some of these features are not supported with Schannel (e.g. HTTP/3, ECH) on any Windows version. - is necessary for HTTP/3 builds, where bootstrapping a CA bundle is not possible with Schannel, because MultiSSL is not an option, and HTTP/3 is not supported with Schannel. Ref: #16181 (previous attempt) Ref: #9348 Ref: #9350 Ref: #13111 Ref: microsoft/vcpkg#46459 (comment) Ref: 22652a5 #14582 Ref: eefd03c #18703 Closes #18279
In AppleSecTrust or NativeCA-enabled builds, make sure override it when setting a custom `CURLOPT_PROXY_CAINFO_BLOB`. Reported-by: Joshua Rogers (Aisle Research) Follow-up to 1730407 curl#18279 Follow-up to eefd03c curl#18703 Closes curl#21631
5 participants
