I'd like to know if this example is enough to provide certificate pinning with libcurl: http://curl.haxx.se/libcurl/c/cacertinmem.html
because I have found that curl also allows http://curl.haxx.se/libcurl/c/CURLOPT_PINNEDPUBLICKEY.html
Since I'll be using a self-signed certificate and only trust on it I don't know if it's truly necessary to pinn it too.
resume: Can the connection be compromised if I only add my certificate (self-signed) to the x509 certificate store like the example? do I need to add extra checks? do I need to use the CURLOPT_PINNEDPUBLICKEY option?
Thanks.
You can find another example in the implementation of the new curl option in git 2.8 (March 2016):
See commit aeff8a6 (15 Feb 2016) by Christoph Egger ( siccegge
) .
(Merged by Junio C Hamano -- gitster
-- in commit e79112d , 24 Feb 2016)
http
: implement public key pinningAdd the
http.pinnedpubkey
configuration option for public key pinning. It allows any string supported bylibcurl
--base64(sha256(pubkey))
orfilename
of the full public key.If cURL does not support pinning (is too old) output a warning to the user.
The git config
man page mentions:
http.pinnedpubkey:
Public key of the https service.
It may either be the filename of a PEM or DER encoded public key file or a string starting with 'sha256//
' followed by the base64 encoded sha256 hash of the public key. See also libcurl 'CURLOPT_PINNEDPUBLICKEY' .
git will exit with an error if this option is set but not supported by cURL.
The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.