All,

I'm having an issue with curl and ssl peer validation. The problem is that SSL peer and host verification don't work in PHP's curl implementation (on two of my machines), nor does it work via curl CLI on those same machines. The host that should be rejected is:

https://test-id.net

It's part of an OpenID suite of tests, and has a revoked cert. wget does detect the revoked cert and prevents you from connecting without disabling verification via an option. But curl says it's verified.

I've tried pointing curl's CAPATH to use /etc/ssl/certs (openssl ca bundles), but it still fails. I've also downloaded the curl's latest bundle pem file, and pointed the request to that, but it still thinks it's verified.

Any thoughts?

Thanks!

Bill Shupp

-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-users
FAQ: http://curl.haxx.se/docs/faq.html
Etiquette: http://curl.haxx.se/mail/etiquette.html
Received on 2009-11-30