I know which Certificate Authority (CA) my server uses for its TLS certs.

My client system also knows who the CA is.

When I use cURL, I can specify --cacert to specify a custom CA file to use, but it seems that this is used IN ADDITION to the trusted CAs installed on my system, not instead of.

So is there a way of telling cURL to ONLY accept CA certs that I know to expect, when making a connection to my server?

Otherwise, I can't detect a rogue CA from issuing a cert for my server unless I manually scrape the verbose connection details during connection...


Good question - in a browser there is certificate pinning. After looking this up I came across the curl flag --pinnedpubkey

Certificate pinning

TLS certificate pinning is a way to verify that the public key used to sign the servers certificate has not changed. It is "pinned".

When negotiating a TLS or SSL connection, the server sends a certificate indicating its identity. A public key is extracted from this certificate and if it does not exactly match the public key provided to this option, curl will abort the connection before sending or receiving any data.

You tell curl a file name to read the sha256 value from, or you specify the base64 encoded hash directly in the command line with a sha256// prefix. You can specify one or more hashes like that, separated with semicolons (;).

curl --pinnedpubkey "sha256//83d34tasd3rt..." https://example.com/ This feature is not supported by all TLS backends.

Reference: https://ec.haxx.se/usingcurl-tls.html

  • It's a good answer, but doesn't work for me - I know the root CA for the server issuing my certs, but I have no visibility of the certs themselves, so am unable to use this option. – StampyCode Jan 10 '19 at 16:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.