I was reading about digital signatures and certificates and from what I've read, when you receive a certificate from a website, you verify CA's identity with a list of CA stored in the web browser.

My question is, what If I am using a desktop client or terminal to make a request to the webserver? How does verification happen in that case?

  • How exactly do you make that request? – Tom K. Jan 11 '18 at 18:02
  • Through code like from nodejs or python – Taran Vohra Jan 11 '18 at 20:44

Your client will usually perform the same checks. Get the certificate, and check that it can trace it back to a known root certificate (possibly via one or more intermediate certificates, forming a "certificate chain").

This is the case with curl for instance:

  • you can specify the list of acceptable CA certs using the --cacert option
  • you can disable the check using --insecure (or -k)

The list of acceptable root certificates may vary from one tool to another (it may also depend on the operating system). Some will use a system-wide list, while others will use their own list.

Some tools may not do the verification automatically (or at all), but you'll need to give us details of the specific tool if you want more details.

| improve this answer | |
  • Suppose I make a request to a web API using nodejs (https module), in that case there won't be any verification of the certificate sent by the webserver right? – Taran Vohra Jan 11 '18 at 13:54
  • @TaranVohra I believe by default the https client will check the certificate against the list of certificates curated by Mozilla. You can override this using the ca option, though you can easily check for yourself. Set up a server with a self-signed cert and trying connecting to it with default settings... – jcaron Jan 11 '18 at 14:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.