1---
2c: Copyright (C) Daniel Stenberg, <daniel.se>, et al.
3SPDX-License-Identifier: curl
4Title: CURLOPT_CRLFILE
5Section: 3
6Source: libcurl
7See-also:
8  - CURLOPT_PROXY_CRLFILE (3)
9  - CURLOPT_SSL_VERIFYHOST (3)
10  - CURLOPT_SSL_VERIFYPEER (3)
11---
12
13# NAME
14
15CURLOPT_CRLFILE - Certificate Revocation List file
16
17# SYNOPSIS
18
19~~~c
20#include <curl/curl.h>
21
22CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CRLFILE, char *file);
23~~~
24
25# DESCRIPTION
26
27Pass a char pointer to a null-terminated string naming a *file* with the
28concatenation of CRL (in PEM format) to use in the certificate validation that
29occurs during the SSL exchange.
30
31When curl is built to use GnuTLS, there is no way to influence the use of CRL
32passed to help in the verification process.
33
34When libcurl is built with OpenSSL support, X509_V_FLAG_CRL_CHECK and
35X509_V_FLAG_CRL_CHECK_ALL are both set, requiring CRL check against all the
36elements of the certificate chain if a CRL file is passed. Also note that
37CURLOPT_CRLFILE(3) implies **CURLSSLOPT_NO_PARTIALCHAIN** (see
38CURLOPT_SSL_OPTIONS(3)) since curl 7.71.0 due to an OpenSSL bug.
39
40This option makes sense only when used in combination with the
41CURLOPT_SSL_VERIFYPEER(3) option.
42
43A specific error code (*CURLE_SSL_CRL_BADFILE*) is defined with the option. It
44is returned when the SSL exchange fails because the CRL file cannot be
45loaded. A failure in certificate verification due to a revocation information
46found in the CRL does not trigger this specific error.
47
48The application does not have to keep the string around after setting this
49option.
50
51# DEFAULT
52
53NULL
54
55# PROTOCOLS
56
57All TLS-based protocols
58
59# EXAMPLE
60
61~~~c
62int main(void)
63{
64  CURL *curl = curl_easy_init();
65  if(curl) {
66    CURLcode res;
67    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
68    curl_easy_setopt(curl, CURLOPT_CRLFILE, "/etc/certs/crl.pem");
69    res = curl_easy_perform(curl);
70    curl_easy_cleanup(curl);
71  }
72}
73~~~
74
75# AVAILABILITY
76
77Added in 7.19.0
78
79# RETURN VALUE
80
81Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
82CURLE_OUT_OF_MEMORY if there was insufficient heap space.
83