使用 libcurl 进行自定义 SSL 证书验证

Question

I need libcurl to accept self-signed certs but I don't want them to be blindly accepted. I need to be able to verify the certificates are the expected self-signed certs before allowing the connection to proceed.

In .NET this is done by setting a RemoteCertificateValidationCallback with the SslStream or HttpWebRequest. The callback provides the certificates and a check can be made to verify the details are expected. In case you are wondering, I have a secure method of distributing the cert details to the agents that need them.

With libcurl, the closest thing to a SSL callback is CURLOPT_SSL_CTX_FUNCTION however the docs state:

This callback function gets called by libcurl just before the initialization of an SSL connection after having processed all other SSL related options to give a last chance to an application to modify the behavior of the SSL initialization.

That means that the callback is called before the actual SSL connection is made which means the certificates have not been received yet to verify. Unless I'm misunderstanding what I can do in that callback, is there a way to do my own SSL verification with libcurl?

Answer 1

@0xdeadbeef You can use SSL callback. In that, you will receive SSL_CTX*. Use this pointer to change the default 'verify' function and point it to your own 'verify' method. You need to use SSL_CTX_set_verify. ['https://www.openssl.org/docs/man1.0.2/man3/SSL_CTX_set_verify.html']