mirror of https://github.com/curl/curl.git synced 2025-02-05 14:30:10 +08:00

- similar to openssl, use a shared 'credentials' instance
  among TLS connections with a plain configuration.
- different to openssl, a connection with a client certificate
  is not eligible to sharing.
- document CURLOPT_CA_CACHE_TIMEOUT in man page

Closes #13795

2024-06-04 08:17:55 +02:00

1.9 KiB

Raw Blame History

SPDX-License-Identifier

Title

Section

Source

See-also

Protocol

TLS-backend

curl

CURLOPT_CA_CACHE_TIMEOUT

libcurl

CURLOPT_CAINFO (3)

CURLOPT_CAINFO_BLOB (3)

CURLOPT_CAPATH (3)

CURLOPT_SSL_VERIFYHOST (3)

CURLOPT_SSL_VERIFYPEER (3)

TLS

GnuTLS

OpenSSL

Schannel

wolfSSL

NAME

CURLOPT_CA_CACHE_TIMEOUT - life-time for cached certificate stores

SYNOPSIS

#include <curl/curl.h>

CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CA_CACHE_TIMEOUT, long age);

DESCRIPTION

Pass a long, this sets the timeout in seconds. This tells libcurl the maximum time any cached CA certificate store it has in memory may be kept and reused for new connections. Once the timeout has expired, a subsequent fetch requiring a CA certificate has to reload it.

Building a CA certificate store from a CURLOPT_CAINFO(3) file is a slow operation so curl may cache the generated certificate store internally to speed up future connections.

Set the timeout to zero to completely disable caching, or set to -1 to retain the cached store remain forever. By default, libcurl caches this info for 24 hours.

DEFAULT

86400 (24 hours)

EXAMPLE

int main(void)
{
  CURL *curl = curl_easy_init();
  if(curl) {
    CURLcode res;
    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");

    /* only reuse certificate stores for a short time */
    curl_easy_setopt(curl, CURLOPT_CA_CACHE_TIMEOUT, 60L);

    res = curl_easy_perform(curl);

    /* in this second request, the cache is not used if more than
       sixty seconds passed since the previous connection */
    res = curl_easy_perform(curl);

    curl_easy_cleanup(curl);
  }
}

AVAILABILITY

This option was added in curl 7.87.0.

This option is supported by OpenSSL and its forks (since 7.87.0), Schannel (since 8.5.0), wolfSSL (since 8.9.0) and GnuTLS (since 8.9.0).

RETURN VALUE

Returns CURLE_OK

1.9 KiB Raw Blame History