Have cURL extension look for certificates in directory set by "openssl.capath"
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 40.4k
- Forks
- 8.1k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 96
Description
Description
I'm on Windows using openssl.cafile and a cacert.pem from curl.se . I also got a local CA certificate that I use. So far I've been just editing any new cacert.pem file to add my certificate. Been working great, but wanted to test if cURL would use openssl.capath to look for it. However, it was just ignoring even with the correct filname (<certificate hash>.0), not even making any access to the directory I set. Only using CURLOPT_CAPATH in the PHP script made it look for the certificate.
Checked out branch "PHP-8.1.22" and looked into ext/curl/interface.c and did the following:
@@ -1817,6 +1817,7 @@ static void create_certinfo(struct curl_certinfo *ci, zval *listcode)
static void _php_curl_set_default_options(php_curl *ch)
{
char *cainfo;
+ char *capath;
curl_easy_setopt(ch->cp, CURLOPT_NOPROGRESS, 1);
curl_easy_setopt(ch->cp, CURLOPT_VERBOSE, 0);
@@ -1840,6 +1841,11 @@ static void _php_curl_set_default_options(php_curl *ch)
if (cainfo && cainfo[0] != '\0') {
curl_easy_setopt(ch->cp, CURLOPT_CAINFO, cainfo);
}
+
+ capath = INI_STR("openssl.capath");
+ if (capath && capath[0] != '\0') {
+ curl_easy_setopt(ch->cp, CURLOPT_CAPATH, capath);
+ }
#ifdef ZTS
curl_easy_setopt(ch->cp, CURLOPT_NOSIGNAL, 1);
Compiled and tested to be working.
Could also consider adding curl.capath as a setting.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in ext/curl/interface.c at _php_curl_set_default_options and compare the existing openssl.cafile handling with the proposed openssl.capath change. Build and test the cURL extension on Windows with a hashed certificate in the configured directory; done means cURL uses openssl.capath without requiring CURLOPT_CAPATH in the PHP script.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, php
- Domain
- networking, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100