Comment by d-z-m | Hacker News Reader

Comment by d-z-m | Hacker News Reader

Presumably apple are setting this[0]? Emphasis mine.

  CURLSSLOPT_NATIVE_CA

  Tell libcurl to use the operating system's native CA store for certificate verification. If you set this option and *also set a CA certificate file* or directory then during verification those certificates are searched in addition to the native CA store.

It seems as though if the --cacert and this option are combined, libcurl tries to honor both of them. Perhaps they should be mutually exclusive?

No, that's not the case. `curl` the binary knows how to call `libcurl` the library.

Right. I'm more suggesting that this combination of options should be handled differently inside of libcurl. E.g. either you want the native store for validation, or you don't. If you "also set a CA certificate file" as per the libcurl docs, presumably you want to use that cert only, and no others.

I'm not too familiar with how the library works internally, but I was imagining something like the above would be possible.

It isn't (lib)curl that's doing this, it's Apple's own version of LibreSSL that curl is built against on macOS.

There's nothing curl can do about it.

Reply on news.ycombinator.com