1---
2c: Copyright (C) Daniel Stenberg, <daniel.se>, et al.
3SPDX-License-Identifier: curl
4Title: CURLOPT_SSLCERT
5Section: 3
6Source: libcurl
7See-also:
8  - CURLOPT_KEYPASSWD (3)
9  - CURLOPT_SSLCERTTYPE (3)
10  - CURLOPT_SSLKEY (3)
11---
12
13# NAME
14
15CURLOPT_SSLCERT - SSL client certificate
16
17# SYNOPSIS
18
19~~~c
20#include <curl/curl.h>
21
22CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSLCERT, char *cert);
23~~~
24
25# DESCRIPTION
26
27Pass a pointer to a null-terminated string as parameter. The string should be
28the filename of your client certificate. The default format is "P12" on Secure
29Transport and "PEM" on other engines, and can be changed with
30CURLOPT_SSLCERTTYPE(3).
31
32With Secure Transport, this can also be the nickname of the certificate you
33wish to authenticate with as it is named in the security database. If you want
34to use a file from the current directory, please precede it with "./" prefix,
35in order to avoid confusion with a nickname.
36
37(Schannel only) Client certificates can be specified by a path expression to a
38certificate store. (You can import *PFX* to a store first). You can use
39"<store location><store name><thumbprint>" to refer to a certificate in the
40system certificates store, for example,
41**"CurrentUserMY934a7ac6f8a5d579285a74fa"**. The thumbprint is usually a SHA-1
42hex string which you can see in certificate details. Following store locations
43are supported: **CurrentUser**, **LocalMachine**, **CurrentService**,
44**Services**, **CurrentUserGroupPolicy**, **LocalMachineGroupPolicy**,
45**LocalMachineEnterprise**. Schannel also support P12 certificate file, with
46the string "P12" specified with CURLOPT_SSLCERTTYPE(3).
47
48When using a client certificate, you most likely also need to provide a
49private key with CURLOPT_SSLKEY(3).
50
51The application does not have to keep the string around after setting this
52option.
53
54# DEFAULT
55
56NULL
57
58# PROTOCOLS
59
60All TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.
61
62# EXAMPLE
63
64~~~c
65int main(void)
66{
67  CURL *curl = curl_easy_init();
68  if(curl) {
69    CURLcode res;
70    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
71    curl_easy_setopt(curl, CURLOPT_SSLCERT, "client.pem");
72    curl_easy_setopt(curl, CURLOPT_SSLKEY, "key.pem");
73    curl_easy_setopt(curl, CURLOPT_KEYPASSWD, "s3cret");
74    res = curl_easy_perform(curl);
75    curl_easy_cleanup(curl);
76  }
77}
78~~~
79
80# AVAILABILITY
81
82If built TLS enabled.
83
84# RETURN VALUE
85
86Returns CURLE_OK if TLS enabled, CURLE_UNKNOWN_OPTION if not, or
87CURLE_OUT_OF_MEMORY if there was insufficient heap space.
88