Download
Browse source Changelog
Documentation
Project   Help us   Known bugs   TODO Protocols   CA bundle   HTTP Cookies   HTTP/2   SSL Certs Releases   Security   Version numbers   Vulnerabilities curl tool   man page   Tutorial   HTTP scripting Who and Why
libcurl
ABI API Competitors Examples Features Mailing list Related libs Using libcurl Tutorial Testimonials
Get Help
curl-library curl-users curl-announce curl-commits Book: Everything curl Report a bug Mail Etiquette
Development
Autobuilds Code Style Contribute Internals Release Notes Release Procedure Roadmap Run Tests Security Specifications Test curl
News
Changelog Release table
curl / Mailing Lists / curl-library / Single Mail

curl-library

Re: HTTPS-only curl mirrors

From: Ryan Schmidt <curl_at_ryandesign.com>
Date: Sun, 26 Nov 2017 09:55:56 -0600

On Nov 26, 2017, at 09:38, Daniel Stenberg wrote:

> I've just pushed changes to the curl web site that makes it no longer link to download mirrors that aren't using HTTPS.
>
> I blogged about it here:
>
> https://daniel.haxx.se/blog/2017/11/26/https-only-curl-mirrors/

The curl and openssl bundled with OS X 10.8.x and earlier cannot connect to your https server.

$ /usr/bin/curl -I https://curl.haxx.se/download/curl-7.56.1.tar.gz
curl: (35) error:1407742E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert protocol version

MacPorts uses that copy of libcurl. For this reason, MacPorts will continue to mirror your files on a CDN server with less restrictive https settings and which also allows http connections for even older systems.

MacPorts checksums the files it downloads, so it is not possible for a MITM attack on this or any other server MacPorts uses to result in MacPorts installing malicious code.

-------------------------------------------------------------------
Unsubscribe: https://cool.haxx.se/list/listinfo/curl-library
Etiquette: https://curl.haxx.se/mail/etiquette.html
Received on 2017-11-26