Buy commercial curl support. We
help you work out your issues, debug your libcurl applications, use the API,
port to new platforms, add new features and more. With a team lead by the
curl founder Daniel himself.
[CurlOne] PEM Certificate Auto-Injection Strategy for Portable LibreSSL Builds
- Contemporary messages sorted: [ by date ] [ by thread ] [ by subject ] [ by author ] [ by messages with attachments ]
From: Michael via curl-and-php <curl-and-php_at_lists.haxx.se>
Date: Wed, 5 Aug 2026 09:11:24 +0500
Architecture Overview
The implementation eliminates target host system trust store
dependencies (such as Windows CryptoAPI/Schannel or system
/etc/ssl/certs directories) by pairing a static php-sm-curl.pem root
bundle alongside the compiled extension binary (.dll or .so). The
module dynamic path discovery phase resolves the location during
initialization and configures handle default options via
CURLOPT_CAINFO.
The core purpose of this feature is to deliver zero-configuration,
standalone HTTPS capabilities for portable CLI runtime environments.
Primary Objectives
⑴ Eliminate System Trust Store Dependencies: Standard LibreSSL builds
on Windows and minimalist BSD/Linux environments lack unified access
to OS root certificate stores. Co-locating the PEM file ensures peer
verification works out of the box without requiring native CryptoAPI
hooks or system /etc/ssl/certs configurations.
⑵ Remove Runtime Directive Overhead: Eliminates the requirement for
end users or deployment scripts to manually configure curl.cainfo
paths within php.ini across varying host environments.
⑶ Enforce Execution Determinism: Guarantees consistent TLS handshake
validation behavior across all host machines by shipping an explicit,
known set of Root Certificate Authorities alongside the extension
binary itself.
⑷ Simplify Application Packaging: Facilitates self-contained CLI tool
distribution where binary folders can be copied to target systems and
run immediately without installation procedures or host system
modifications.
Date: Wed, 5 Aug 2026 09:11:24 +0500
Architecture Overview
The implementation eliminates target host system trust store
dependencies (such as Windows CryptoAPI/Schannel or system
/etc/ssl/certs directories) by pairing a static php-sm-curl.pem root
bundle alongside the compiled extension binary (.dll or .so). The
module dynamic path discovery phase resolves the location during
initialization and configures handle default options via
CURLOPT_CAINFO.
The core purpose of this feature is to deliver zero-configuration,
standalone HTTPS capabilities for portable CLI runtime environments.
Primary Objectives
⑴ Eliminate System Trust Store Dependencies: Standard LibreSSL builds
on Windows and minimalist BSD/Linux environments lack unified access
to OS root certificate stores. Co-locating the PEM file ensures peer
verification works out of the box without requiring native CryptoAPI
hooks or system /etc/ssl/certs configurations.
⑵ Remove Runtime Directive Overhead: Eliminates the requirement for
end users or deployment scripts to manually configure curl.cainfo
paths within php.ini across varying host environments.
⑶ Enforce Execution Determinism: Guarantees consistent TLS handshake
validation behavior across all host machines by shipping an explicit,
known set of Root Certificate Authorities alongside the extension
binary itself.
⑷ Simplify Application Packaging: Facilitates self-contained CLI tool
distribution where binary folders can be copied to target systems and
run immediately without installation procedures or host system
modifications.
-- curl-and-php mailing list curl-and-php_at_lists.haxx.se https://lists.haxx.se/mailman/listinfo/curl-and-phpReceived on 2026-08-05