UPGRADE


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

Upgrading to curl/libcurl 7.10 from any previous version
========================================================

libcurl 7.10 performs peer SSL certificate verification by default. This is
done by installing a default CA cert bundle on 'make install' (or similar),
that is used by default on operations against SSL servers.

Alas, if you use communicate with HTTPS servers using certifcates that are
signed by CAs present in the bundle, you will not notice and changed behavior
and you will seeminglessly get a higher security level on your SSL connections
since you will make sure that the remote server really is who it claims to be.

If the remote server uses a self-signed certificate, or if you don't install
curl's CA cert bundle or if it uses a certificate signed by a CA that isn't
included in the bundle, then you need to do one of the following:

 1. Tell libcurl to *not* verify the peer. With libcurl you disable with with
    curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, FALSE);

    With the curl command tool, you disable this with -k/--insecure.

 2. Get a CA certificate that can verify the remote server and use the proper
    option to point out this CA cert for verification when connecting. For
    libcurl hackers: curl_easy_setopt(curl, CURLOPT_CAPATH, capath);

    With the curl command tool: --cacert [file]

This upgrade procedure has been deemed The Right Thing even though it adds
this extra trouble for some users, since it adds security to a majority of the
SSL connections that previously weren't really secure.

It turned out many people were using previous versions of curl/libcurl without
realizing the need for the CA cert options to get truly secure SSL
connections.