How to make libcurl look in the Mac Keychain for certificates

My code is trying to access an HTTPS server and it has its own certificate. Example, the IP is "10.0.1.101".

If I go through Safari and access "http://10.0.1.101", everything's OK. I do a simple curl_easy_perform() for this URL and data can be pulled from the HTTP URL. Cool.

I then try to access "https://10.0.1.101" (yes, HTTPS) and from Safari, I accept the certificate and give it a "trust" option and after that, Safari access to the HTTPS URL is OK.

So the certificate has been added to the Mac Keychain but when I try a curl_easy_perform() on the HTTPS URL, it still returns with a CURLE_SSL_CACERT. libcurl could not authenticate the HTTPS certificate with known CA certificates.

What is the missing link betw开发者_Go百科een libcurl's certificate checking and Mac Keychain? Is there even a link at all? Is it possible to make libcurl look into the Mac Keychain for certificates? If so, how?

"New" curl on Mac OS does not "look" at system Keychain database (old curl versions worked great with -E option).

You can still make it work with curl on newer versions of Mac OS:

brew install curl

(installs version of curl that works with Client Certificates read from Keychain)

and then something like:

/usr/local/opt/curl/bin/curl -E wlad https://mail.securedbyclientcertificate.com/access/

(in -E you type name of your client certificate in Keychain database)

Mac OS will ask you for permission to read from Keychain, type your MacOS password and select "Always Allow"..

Nope. libcurl built to use OpenSSL will only read CA certs from a single PEM file or from a directory of CA certs that have been prepared OpenSSL-style.

There's no special magic for the Mac Keychain implemented.

In current versions of MacOS you can tell the system installed curl to use the Keychain using the CURL_SSL_BACKEND environment variable e.g. to use a named client cert from the Keychain (it will pop up a Keychain authentication dialogue):

CURL_SSL_BACKEND=secure-transport curl --cert "My Cert" htps://10.0.1.101/