I know which Certificate Authority (CA) my server uses for its TLS certs.
My client system also knows who the CA is.
When I use cURL, I can specify
--cacert to specify a custom CA file to use, but it seems that this is used IN ADDITION to the trusted CAs installed on my system, not instead of.
So is there a way of telling cURL to ONLY accept CA certs that I know to expect, when making a connection to my server?
Otherwise, I can't detect a rogue CA from issuing a cert for my server unless I manually scrape the verbose connection details during connection...