curl SSL/TLS Configuration
Configure SSL/TLS in curl including certificate verification, client certificates, minimum TLS versions, cipher suites, and certificate pinning options.
Detailed Explanation
SSL/TLS Configuration in curl
curl supports extensive SSL/TLS configuration for secure HTTPS connections. Understanding these options is critical for debugging certificate issues and enforcing security policies.
Skip Certificate Verification
For development and testing only, use -k to skip SSL verification:
curl -k https://self-signed.example.com/api
Warning: Never use -k in production. It disables all certificate checks, making the connection vulnerable to man-in-the-middle attacks.
Custom CA Bundle
Specify a custom Certificate Authority bundle:
curl --cacert /path/to/ca-bundle.crt https://api.example.com/data
Or a directory of CA certificates:
curl --capath /path/to/certs/ https://api.example.com/data
Client Certificate Authentication (mTLS)
Mutual TLS requires the client to present a certificate:
curl --cert client.crt --key client.key https://api.example.com/secure
With a passphrase-protected key:
curl --cert client.crt --key client.key --pass "mypassphrase" \
https://api.example.com/secure
Combined PEM file:
curl --cert client.pem https://api.example.com/secure
Enforcing TLS Versions
Force a minimum TLS version:
curl --tlsv1.2 https://api.example.com/data # TLS 1.2 or higher
curl --tlsv1.3 https://api.example.com/data # TLS 1.3 only
Viewing Certificate Information
curl -vI https://example.com 2>&1 | grep -A 6 "Server certificate"
Checking Certificate Expiry
curl -vI https://example.com 2>&1 | grep "expire date"
Pinning a Certificate
Pin a specific public key hash:
curl --pinnedpubkey "sha256//YhKJKSzoTt2b5FP18fvpHo7fJYqQCjAa3HWY3tvRMwE=" \
https://api.example.com/data
Common SSL Errors and Fixes
| Error | Cause | Fix |
|---|---|---|
SSL certificate problem: unable to get local issuer certificate |
Missing CA bundle | Use --cacert |
SSL certificate problem: certificate has expired |
Expired cert | Update server cert |
SSL peer certificate or SSH remote key was not OK |
Hostname mismatch | Check certificate SAN |
TLS handshake failure |
TLS version mismatch | Try --tlsv1.2 |
Understanding SSL/TLS options is essential for debugging HTTPS issues and implementing secure API communication in production environments.
Use Case
A security engineer needs to verify SSL certificate configurations, enforce minimum TLS versions, and set up mutual TLS authentication for API endpoints.