cURL / Mailing Lists / curl-library / Single Mail


Using default cert bundle with PolarSSL

From: Jeff Pohlmeyer <>
Date: Mon, 23 Aug 2010 08:09:45 -0500

I've been playing around with a polarssl-enabled build of libcurl and
the "ca-certificates.crt" generated by "" is failing
with error -0x01A0. The polarssl sources define that error code as:

After some trial and error, I found that currently the only culprit
is the cert from "COMODO ECC Certification Authority" which has a
signature algorithm of "ecdsa-with-SHA384"

The quick fix is to manually remove the offending cert from the bundle,
after that polarssl can handle all the other certs just fine.

The attached "mk-ca-bundle.lua" script contains a workaround that will
(hopefully) exclude any certs with signature algorithms that polarssl
doesn't understand. The workaround is turned off by default, you can
enable it with the -p option.

As a side note, while browsing the libcurl mailing list archives I came
across this thread:

which implies that libcurl+polarssl will not work with self-signed

I can say that at least for me, self-signed certs are working just fine.
(Provided of course that they are in a format that polarssl understands.)

 - Jeff

List admin:

Received on 2010-08-23