Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Document --cert escape handling #9349

Closed
wants to merge 4 commits into from
Closed

Document --cert escape handling #9349

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
5e39ed7
doc: clarify that escape character works for file paths
jacobtolar Aug 22, 2022
caa8cb3
vtls: add cert path in error message
jacobtolar Aug 22, 2022
fefe51c
address review suggestions
jacobtolar Aug 27, 2022
257ac0a
remove duplicate text
jacobtolar Aug 27, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
21 changes: 13 additions & 8 deletions docs/cmdline-opts/cert.d
View file
Open in desktop
Expand Up @@ -14,19 +14,24 @@ Tells curl to use the specified client certificate file when getting a file
with HTTPS, FTPS or another SSL-based protocol. The certificate must be in
PKCS#12 format if using Secure Transport, or PEM format if using any other
engine. If the optional password is not specified, it will be queried for on
the terminal. Note that this option assumes a \&"certificate" file that is the
private key and the client certificate concatenated! See --cert and --key to
specify them independently.
the terminal if required. Note that this option assumes a \&"certificate"
bagder marked this conversation as resolved.
Show resolved Hide resolved
file that is the private key and the client certificate concatenated! See
--cert and --key to specify them independently.

If curl is built against the NSS SSL library then this option can tell
curl the nickname of the certificate to use within the NSS database defined
by the environment variable SSL_DIR (or by default /etc/pki/nssdb). If the
NSS PEM PKCS#11 module (libnsspem.so) is available then PEM files may be
loaded. If you want to use a file from the current directory, please precede
it with "./" prefix, in order to avoid confusion with a nickname. If the
nickname contains ":", it needs to be preceded by "\\" so that it is not
recognized as password delimiter. If the nickname contains "\\", it needs to
be escaped as "\\\\" so that it is not recognized as an escape character.
loaded.

If you intend to use a certificate file and provide a path relative to the
bagder marked this conversation as resolved.
Show resolved Hide resolved
current directory, you must prefix the path with "./" in order to avoid
confusion with an NSS database nickname.

If the NSS nickname or certificate filename contains the character ":", it
must be prefixed by "\\" so that it is not recognized as the password
delimiter. Similarly, if the nickname or filename contains "\\", it must be
escaped as "\\\\" so that it is not recognized as an escape character.
bagder marked this conversation as resolved.
Show resolved Hide resolved

If curl is built against OpenSSL library, and the engine pkcs11 is available,
then a PKCS#11 URI (RFC 7512) can be used to specify a certificate located in
Expand Down
6 changes: 4 additions & 2 deletions lib/vtls/openssl.c
View file
Open in desktop
Expand Up @@ -793,9 +793,10 @@ int cert_stuff(struct Curl_easy *data,
SSL_CTX_use_certificate_chain_file(ctx, cert_file);
if(cert_use_result != 1) {
failf(data,
"could not load PEM client certificate, " OSSL_PACKAGE
"could not load PEM client certificate from %s, " OSSL_PACKAGE
" error %s, "
"(no key found, wrong pass phrase, or wrong file format?)",
(cert_blob ? "CURLOPT_SSLCERT_BLOB" : cert_file),
ossl_strerror(ERR_get_error(), error_buffer,
sizeof(error_buffer)) );
return 0;
Expand All @@ -813,9 +814,10 @@ int cert_stuff(struct Curl_easy *data,
SSL_CTX_use_certificate_file(ctx, cert_file, file_type);
if(cert_use_result != 1) {
failf(data,
"could not load ASN1 client certificate, " OSSL_PACKAGE
"could not load ASN1 client certificate from %s, " OSSL_PACKAGE
" error %s, "
"(no key found, wrong pass phrase, or wrong file format?)",
(cert_blob ? "CURLOPT_SSLCERT_BLOB" : cert_file),
ossl_strerror(ERR_get_error(), error_buffer,
sizeof(error_buffer)) );
return 0;
Expand Down