cURL

curl's project page on SourceForge.net

Sponsors:
Haxx

cURL > Mailing List > Monthly Index > Single Mail

curl-tracker Archives

[curl:bugs] #1348 RFE: add API for certificate pinning

From: Daniel Stenberg <bagder_at_users.sf.net>
Date: Mon, 24 Mar 2014 15:46:02 +0000

- **labels**: --> SSL/TLS, certificate
- **assigned_to**: Daniel Stenberg
- **Comment**:

Thanks, and yes I agree that such an API would be great and is indeed missing.

Any chance you feel like working on making it happen? (Since this is a feature-request rather than a bug, I'll move it to the feature-request tracker later on.)

---
** [bugs:#1348] RFE: add API for certificate pinning**
**Status:** open
**Labels:** SSL/TLS certificate 
**Created:** Mon Mar 24, 2014 03:33 PM UTC by Enrico Scholz
**Last Updated:** Mon Mar 24, 2014 03:33 PM UTC
**Owner:** Daniel Stenberg
When using security sensitive applications (e.g. for accessing the Mozilla Persona verifier), it is often useful to do SSL certificate pinning instead of trusting into the x509 CA system.
It would be nice when curl has an API supporting certificate pinning. This API should be reliable, easy to use and should be working across all the SSL backends ;) Unfortunately, this is not the case with the current library. E.g. CURLOPT_CERTINFO + CURLOPT_SSL_CTX_FUNCTION is supported with OpenSSL only, passing the certificate instead of the chain in CURLOPT_CAINFO works with OpenSSL only too.
For certificate pinning, an easy access to the certificate fingerprint would be ideal. E.g. a CURLOPT_CERTFP option could be added which returns the fingerprint in CURLINFO_CERTFP.  Type of hash could be either selected by the value of CURLOPT_CERTFP or by providing multiple CURLINFO_CERTFP_<hash> results.  atm, I would prefer the first method.
Alternatively, the whole certificate could be returned by CURLOPT_CERTIFICATE and CURLINFO_CERTIFICATE_DER/PEM options.
---
Sent from sourceforge.net because curl-tracker@cool.haxx.se is subscribed to https://sourceforge.net/p/curl/bugs/
To unsubscribe from further messages, a project admin can change settings at https://sourceforge.net/p/curl/admin/bugs/options.  Or, if this is a mailing list, you can unsubscribe from the mailing list.
Received on 2014-03-24

These mail archives are generated by hypermail.

donate! Page updated March 21, 2014.
web site info

File upload with ASP.NET