1---
2c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
3SPDX-License-Identifier: curl
4Title: CURLOPT_PROXY_CRLFILE
5Section: 3
6Source: libcurl
7See-also:
8  - CURLOPT_PROXY_SSL_VERIFYHOST (3)
9  - CURLOPT_PROXY_SSL_VERIFYPEER (3)
10  - CURLOPT_SSL_VERIFYHOST (3)
11  - CURLOPT_SSL_VERIFYPEER (3)
12Protocol:
13  - TLS
14TLS-backend:
15  - GnuTLS
16  - mbedTLS
17  - OpenSSL
18Added-in: 7.52.0
19---
20
21# NAME
22
23CURLOPT_PROXY_CRLFILE - HTTPS proxy Certificate Revocation List file
24
25# SYNOPSIS
26
27~~~c
28#include <curl/curl.h>
29
30CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_CRLFILE, char *file);
31~~~
32
33# DESCRIPTION
34
35This option is for connecting to an HTTPS proxy, not an HTTPS server.
36
37Pass a char pointer to a null-terminated string naming a *file* with the
38concatenation of CRL (in PEM format) to use in the certificate validation that
39occurs during the SSL exchange.
40
41When curl is built to use GnuTLS, there is no way to influence the use of CRL
42passed to help in the verification process. When libcurl is built with OpenSSL
43support, X509_V_FLAG_CRL_CHECK and X509_V_FLAG_CRL_CHECK_ALL are both set,
44requiring CRL check against all the elements of the certificate chain if a CRL
45file is passed.
46
47This option makes sense only when used in combination with the
48CURLOPT_PROXY_SSL_VERIFYPEER(3) option.
49
50A specific error code (*CURLE_SSL_CRL_BADFILE*) is defined with the option. It
51is returned when the SSL exchange fails because the CRL file cannot be loaded.
52A failure in certificate verification due to a revocation information found in
53the CRL does not trigger this specific error.
54
55The application does not have to keep the string around after setting this
56option.
57
58Using this option multiple times makes the last set string override the
59previous ones. Set it to NULL to disable its use again.
60
61# DEFAULT
62
63NULL
64
65# %PROTOCOLS%
66
67# EXAMPLE
68
69~~~c
70int main(void)
71{
72  CURL *curl = curl_easy_init();
73  if(curl) {
74    CURLcode res;
75    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
76    curl_easy_setopt(curl, CURLOPT_PROXY, "https://localhost:80");
77    curl_easy_setopt(curl, CURLOPT_PROXY_CRLFILE, "/etc/certs/crl.pem");
78    res = curl_easy_perform(curl);
79    curl_easy_cleanup(curl);
80  }
81}
82~~~
83
84# %AVAILABILITY%
85
86# RETURN VALUE
87
88Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or
89CURLE_OUT_OF_MEMORY if there was insufficient heap space.
90