UNLOZE/sourcemod
9
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Backed out updated libcurl.

Browse Source
This commit is contained in:
Asher Baker
2013-03-18 00:55:59 +00:00
parent 9b65900df0
commit e84f6e4afd
1511 changed files with 161513 additions and 213368 deletions
Download Patch File Download Diff File Expand all files Collapse all files
extensions/curl/curl-src/docs/SSLCERTS
+1 -26
View File
@@ -78,7 +78,7 @@ server, do one of the following:
5. all directories along %PATH%
5. Get a better/different/newer CA cert bundle! One option is to extract the
one a recent Firefox browser uses by running 'make ca-bundle' in the curl
one a recent Mozilla browser uses by running 'make ca-bundle' in the curl
build tree root, or possibly download a version that was generated this
way for you:
@@ -89,28 +89,3 @@ certificate that isn't signed by one of the certificates in the installed CA
cert bundle, will cause SSL to report an error ("certificate verify failed")
during the handshake and SSL will then refuse further communication with that
server.
Peer SSL Certificate Verification with NSS
==========================================
If libcurl is build with NSS support then depending on the OS distribution it
is probably required to take some additional steps to use the system-wide CA
cert db. RedHat ships with an additional module libnsspem.so which enables NSS
to read the OpenSSL PEM CA bundle. With OpenSuSE this lib is missing, and NSS
can only work with its own internal formats. Also NSS got a new database
format:
https://wiki.mozilla.org/NSS_Shared_DB
Starting with version 7.19.7 libcurl will check for the NSS version it runs,
and add automatically the 'sql:' prefix to the certdb directory (either the
hardcoded default /etc/pki/nssdb or the directory configured with SSL_DIR
environment variable) if a version 3.12.0 or later is detected.
To check which certdb format your distribution provides examine the default
certdb location /etc/pki/nssdb; the new certdb format can be identified by
the filenames cert9.db, key4.db, pkcs11.txt; filenames of older versions are
cert8.db, key3.db, modsec.db.
Usually these cert databases are empty; but NSS also has built-in CAs which are
provided through a shared library libnssckbi.so; if you want to use these
built-in CAs then create a symlink to libnssckbi.so in /etc/pki/nssdb:
ln -s /usr/lib[64]/libnssckbi.so /etc/pki/nssdb/libnssckbi.so