{"id":278,"date":"2008-02-12T23:02:42","date_gmt":"2008-02-12T22:02:42","guid":{"rendered":"http:\/\/daniel.haxx.se\/blog\/2008\/02\/12\/ca-cert-bundle-or-not\/"},"modified":"2025-02-12T07:57:04","modified_gmt":"2025-02-12T06:57:04","slug":"ca-cert-bundle-or-not","status":"publish","type":"post","link":"https:\/\/daniel.haxx.se\/blog\/2008\/02\/12\/ca-cert-bundle-or-not\/","title":{"rendered":"CA cert bundle or not"},"content":{"rendered":"\n<p>Since the dawn of time (at least it feels that long) we&#8217;ve included a copy of a <a href=\"http:\/\/en.wikipedia.org\/wiki\/Certificate_authority\">ca cert bundle<\/a> in the curl releases. That ca cert bundle originates from Netscape 4.72 and no cert has been added to it since the year 2000(!)<\/p>\n\n\n\n<p>Instead, we&#8217;ve offered things like an <a href=\"http:\/\/curl.haxx.se\/docs\/caextract.html\">easy downloadable version<\/a> from our web site, and <a href=\"http:\/\/curl.haxx.se\/docs\/sslcerts.html\">documented that<\/a> this is what you often need to do.<\/p>\n\n\n\n<p>Anyway, we were recently <a href=\"http:\/\/curl.haxx.se\/bug\/view.cgi?id=1889593\">triggered by a bug report<\/a> and are <a href=\"http:\/\/curl.haxx.se\/mail\/lib-2008-02\/0033.html\">discussing updating the bundle<\/a> in the curl tarballs &#8211; we&#8217;ll just need to sort out the license situation first but we&#8217;re slowly progressing there and I think we&#8217;re pretty fine with things as they are right now.<\/p>\n\n\n\n<p>However, the question is perhaps better put the other way: why should we bother to include a ca cert bundle in the first place? Most users will already have one in their system (since basically all SSL-based applications want one) and those that don&#8217;t can very easily get an updated one using our online server or a recent <a href=\"https:\/\/github.com\/curl\/curl\/blob\/master\/scripts\/mk-ca-bundle.pl\">perl script<\/a> added to the curl source tree.<\/p>\n\n\n\n<p>I hope I don&#8217;t have to tell you that I value all input I can get on this issue!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Since the dawn of time (at least it feels that long) we&#8217;ve included a copy of a ca cert bundle in the curl releases. That ca cert bundle originates from Netscape 4.72 and no cert has been added to it since the year 2000(!) Instead, we&#8217;ve offered things like an easy downloadable version from our &hellip; <a href=\"https:\/\/daniel.haxx.se\/blog\/2008\/02\/12\/ca-cert-bundle-or-not\/\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">CA cert bundle or not<\/span> <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":5,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[33,43],"class_list":["post-278","post","type-post","status-publish","format-standard","hentry","category-curl","tag-curl-and-libcurl","tag-ssl"],"_links":{"self":[{"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/posts\/278","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/comments?post=278"}],"version-history":[{"count":2,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/posts\/278\/revisions"}],"predecessor-version":[{"id":26527,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/posts\/278\/revisions\/26527"}],"wp:attachment":[{"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/media?parent=278"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/categories?post=278"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/tags?post=278"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}