1---
2c: Copyright (C) Daniel Stenberg, <daniel.se>, et al.
3SPDX-License-Identifier: curl
4Title: CURLOPT_CAINFO
5Section: 3
6Source: libcurl
7See-also:
8  - CURLINFO_CAINFO (3)
9  - CURLOPT_CAINFO_BLOB (3)
10  - CURLOPT_CAPATH (3)
11  - CURLOPT_CA_CACHE_TIMEOUT (3)
12  - CURLOPT_SSL_VERIFYHOST (3)
13  - CURLOPT_SSL_VERIFYPEER (3)
14---
15
16# NAME
17
18CURLOPT_CAINFO - path to Certificate Authority (CA) bundle
19
20# SYNOPSIS
21
22~~~c
23#include <curl/curl.h>
24
25CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CAINFO, char *path);
26~~~
27
28# DESCRIPTION
29
30Pass a char pointer to a null-terminated string naming a file holding one or
31more certificates to verify the peer with.
32
33If CURLOPT_SSL_VERIFYPEER(3) is zero and you avoid verifying the
34server's certificate, CURLOPT_CAINFO(3) need not even indicate an
35accessible file.
36
37This option is by default set to the system path where libcurl's CA
38certificate bundle is assumed to be stored, as established at build time.
39
40(iOS and macOS) When curl uses Secure Transport this option is supported. If
41the option is not set, then curl uses the certificates in the system and user
42Keychain to verify the peer.
43
44(Schannel) This option is supported for Schannel in Windows 7 or later but we
45recommend not using it until Windows 8 since it works better starting then.
46If the option is not set, then curl uses the certificates in the Windows'
47store of root certificates (the default for Schannel).
48
49The application does not have to keep the string around after setting this
50option.
51
52The default value for this can be figured out with CURLINFO_CAINFO(3).
53
54# DEFAULT
55
56Built-in system specific. When curl is built with Secure Transport or
57Schannel, this option is not set by default.
58
59# PROTOCOLS
60
61All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
62
63# EXAMPLE
64
65~~~c
66int main(void)
67{
68  CURL *curl = curl_easy_init();
69  if(curl) {
70    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
71    curl_easy_setopt(curl, CURLOPT_CAINFO, "/etc/certs/cabundle.pem");
72    curl_easy_perform(curl);
73    curl_easy_cleanup(curl);
74  }
75}
76~~~
77
78# AVAILABILITY
79
80For the SSL engines that do not support certificate files the
81CURLOPT_CAINFO(3) option is ignored. Schannel support added in libcurl
827.60.
83
84# RETURN VALUE
85
86Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
87CURLE_OUT_OF_MEMORY if there was insufficient heap space.
88