cURL / Mailing Lists / curl-library / Single Mail


Re: [PATCH] openssl: allow partial trust chains

From: Tim Ruehsen <>
Date: Mon, 14 Dec 2015 16:49:01 +0100

On Monday 14 December 2015 15:50:25 Daniel Stenberg wrote:
> On Wed, 25 Nov 2015, Reiner Herrmann wrote:
> > By default OpenSSL only accepts connections if the full chain to the root
> > can be verified. If only an intermediate CA in the chain is trusted,
> > setting this flag also allows the connection when the root CA is not
> > trusted. This is also the default behavior for e.g. GnuTLS.
> Hi again, let's bring this patch back to life.
> What would you say about adding a bit to the CURLOPT_SSL_OPTIONS option to
> allow an application to optionally switch off "partial trust chains" ?

What about adding an option to switch on "partial trust chains" ?

Than take time to discuss this issue with *real experts* and eventually change
the default if you are 100% sure to do the right thing ?


List admin:

Received on 2015-12-14