Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am trying to make a curl request to one of our local development servers running a dev site with a self-signed SSL cert. I am using curl from the command line.

I saw some blog posts mentioning that you can add to the list of certificates or specify a specific (self signed) certificate as valid, but is there a catch-all way of saying "don't verify" the ssl cert - like the --no-check-certificate that wget has?

share|improve this question

2 Answers 2

up vote 64 down vote accepted

Yes. From the manpage:

-k, --insecure (SSL) This option explicitly allows curl to perform "insecure" SSL connections and transfers. All SSL connections are attempted to be made secure by using the CA certificate bundle installed by default. This makes all connections considered "insecure" fail unless -k, --insecure is used.

share|improve this answer
    
Don't know how I missed it. Thank you –  cwd Jan 9 '13 at 16:11
2  
Love the fact that it has a one letter short option –  kizzx2 Jan 20 '13 at 9:39
7  
Worth noting that unlike wget's --no-check-certificate, this disables certificate chain checking but leaves other validation enabled. For example, if the server is using a certificate for the wrong hostname, it will still be rejected. This is good if you just want to accept self-signed certificates. This is bad if you just want to download something from raw.githubusercontent.com, which is currently serving the wrong certificate. –  Tom Anderson Apr 16 at 11:49

You may use the following command to apply the changes for all connections:

$ echo insecure >> ~/.curlrc

On Windows just create .curlrc text file with 'insecure' text in it in your HOME dir.

share|improve this answer
5  
This seems like bad advice: disabling these checks for all connections should not be the default, even if you do this to yourself via per-user configuration. If you need to suppress security checks, at least do it piecemeal. –  Christopher Schultz May 22 at 21:07
    
Anytime I am using curl, I either control or trust the machine at the other end. –  Eric Hartford Sep 3 at 18:00
    
@EricHartford: Well, good for you, but that still doesn't make it a good general advice imho. One might use curl, for instance when downloading homebrew on osx and end up with a modified version of the tools because he enabled this as a default blindly. –  ereOn Oct 19 at 3:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.