cURL / Mailing Lists / curl-library / Single Mail


Re: [PATCH] openssl: allow partial trust chains

From: Daniel Stenberg <>
Date: Mon, 14 Dec 2015 15:50:25 +0100 (CET)

On Wed, 25 Nov 2015, Reiner Herrmann wrote:

> By default OpenSSL only accepts connections if the full chain to the root
> can be verified. If only an intermediate CA in the chain is trusted, setting
> this flag also allows the connection when the root CA is not trusted. This
> is also the default behavior for e.g. GnuTLS.

Hi again, let's bring this patch back to life.

What would you say about adding a bit to the CURLOPT_SSL_OPTIONS option to
allow an application to optionally switch off "partial trust chains" ?

List admin:
Received on 2015-12-14