mirror of
https://github.com/curl/curl.git
synced 2024-12-15 06:40:09 +08:00
ce6e3e5320
Since "too old" versions are no longer included in the generated man page, this field is now mandatory so that it won't be forgotten and then not included in the documentation. Closes #7786
54 lines
2.8 KiB
D
54 lines
2.8 KiB
D
Short: E
|
|
Long: cert
|
|
Arg: <certificate[:password]>
|
|
Help: Client certificate file and password
|
|
Protocols: TLS
|
|
See-also: cert-type key key-type
|
|
Category: tls
|
|
Example: --cert certfile --key keyfile $URL
|
|
Added: 5.0
|
|
---
|
|
Tells curl to use the specified client certificate file when getting a file
|
|
with HTTPS, FTPS or another SSL-based protocol. The certificate must be in
|
|
PKCS#12 format if using Secure Transport, or PEM format if using any other
|
|
engine. If the optional password isn't specified, it will be queried for on
|
|
the terminal. Note that this option assumes a \&"certificate" file that is the
|
|
private key and the client certificate concatenated! See --cert and --key to
|
|
specify them independently.
|
|
|
|
If curl is built against the NSS SSL library then this option can tell
|
|
curl the nickname of the certificate to use within the NSS database defined
|
|
by the environment variable SSL_DIR (or by default /etc/pki/nssdb). If the
|
|
NSS PEM PKCS#11 module (libnsspem.so) is available then PEM files may be
|
|
loaded. If you want to use a file from the current directory, please precede
|
|
it with "./" prefix, in order to avoid confusion with a nickname. If the
|
|
nickname contains ":", it needs to be preceded by "\\" so that it is not
|
|
recognized as password delimiter. If the nickname contains "\\", it needs to
|
|
be escaped as "\\\\" so that it is not recognized as an escape character.
|
|
|
|
If curl is built against OpenSSL library, and the engine pkcs11 is available,
|
|
then a PKCS#11 URI (RFC 7512) can be used to specify a certificate located in
|
|
a PKCS#11 device. A string beginning with "pkcs11:" will be interpreted as a
|
|
PKCS#11 URI. If a PKCS#11 URI is provided, then the --engine option will be set
|
|
as "pkcs11" if none was provided and the --cert-type option will be set as
|
|
"ENG" if none was provided.
|
|
|
|
(iOS and macOS only) If curl is built against Secure Transport, then the
|
|
certificate string can either be the name of a certificate/private key in the
|
|
system or user keychain, or the path to a PKCS#12-encoded certificate and
|
|
private key. If you want to use a file from the current directory, please
|
|
precede it with "./" prefix, in order to avoid confusion with a nickname.
|
|
|
|
(Schannel only) Client certificates must be specified by a path
|
|
expression to a certificate store. (Loading PFX is not supported; you can
|
|
import it to a store first). You can use
|
|
"<store location>\\<store name>\\<thumbprint>" to refer to a certificate
|
|
in the system certificates store, for example,
|
|
"CurrentUser\\MY\\934a7ac6f8a5d579285a74fa61e19f23ddfe8d7a". Thumbprint is
|
|
usually a SHA-1 hex string which you can see in certificate details. Following
|
|
store locations are supported: CurrentUser, LocalMachine, CurrentService,
|
|
Services, CurrentUserGroupPolicy, LocalMachineGroupPolicy,
|
|
LocalMachineEnterprise.
|
|
|
|
If this option is used several times, the last one will be used.
|