为 libcurl 添加自签名 SSL 证书
我在我的 C 应用程序中使用 libcurl 与我设置的 HTTPS 服务器进行通信。我在该服务器上生成了一个自签名证书，我希望将其与curl 一起使用。
我知道将 CURLOPT_SSL_VERIFYPEER 设置为 0 可以绕过 SSL 验证，但我希望将生成的证书添加到curl 的“有效”CA 证书中。
我尝试将CURLOPT_CAPATH和CURLOPT_SSLCERT设置为服务器SSL公钥的位置，但无法通过验证。
如何添加我自己的 CA/自签名证书以便 libcurl 能够成功验证它？
I am using libcurl in my C application to communicate with an HTTPS server that I have set up. I generated a self-signed certificate on that server that I wish to use with curl.
I am aware of setting CURLOPT_SSL_VERIFYPEER to 0 to bypass the SSL verification, but I wish to add the generated certificate to curl's "valid" CA certificates.
I have tried setting CURLOPT_CAPATH and CURLOPT_SSLCERT to the location of the server SSL public key, but it fails to pass the verification.
How can I add my own CA/Self-signed certificate so that libcurl will successfully validate it?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
要添加自签名证书，请使用 CURLOPT_CAINFO
要检索站点的 SSL 公共证书，请使用
证书是由
----BEGIN CERTIFICATE---- 和
---证书结束----。将该证书保存到文件中，并以如下方式使用curl：
To add a self-signed certificate, use CURLOPT_CAINFO
To retrieve the SSL public certificate of a site, use
The certificate is the portion marked by
----BEGIN CERTIFICATE----and---END CERTIFICATE----.Save that certificate into a file, and use curl in a manner like so:
首先，您混合了“证书颁发机构”文件和“证书”文件，这让我感到困惑。
这可能被视为对上述答案的补充。
如果您想要添加自签名 CA（每个根 CA 都是自签名的），以便 libcurl 成功验证由 CA 生成的网站证书，然后继续阅读。
使用 CURLOPT_CAINFO，您需要传递在生成要验证的站点的（非 CA）证书时使用的“证书颁发机构”文件 (CA)。
（我不知道这个选项是否可以通过传递一个非CA证书来工作，文档对此并不是很清楚，并且之前的答案有2个赞成票，所以如果有人测试过它，请发表评论）
您也可以通过包含所使用的 CA 的证书颁发机构链文件（如果它不是根 CA）。
这是我发现的一个小教程，可以帮助您测试您的解决方案：
创建私有根 CA：
http://www.flatmtn.com/article/setting-openssl-create-certificates
创建站点证书：
http://www.flatmtn.com/article/setting-ssl-certificates-apache
First, you kind of mix "Certificate Authority" files and "Certificate" files which confuses me.
This might be seen as a complementary answer to the one above.
In the case you want to add a self-signed CA (every root-CA is self-signed) so that libcurl will successfully validate a website's certificate, which has been generated by the CA, then continue reading.
With CURLOPT_CAINFO you need to pass the "Certificate Authority" file (CA) that was used when generating the (non-CA) certificate of the site you want to verify.
(I do not know if this option works by passing it a non-CA certificate, the documentation is not really clear on this, and the previous answer has 2 up-votes, so if anyone has tested it please comment)
You can also pass a Certificate Authority chain file that contains the CA that was used, in case it was not a root-CA.
Here's a little tutorial I've found that can help you test your solution:
Creating a private root CA:
http://www.flatmtn.com/article/setting-openssl-create-certificates
Creating a site certificate:
http://www.flatmtn.com/article/setting-ssl-certificates-apache