443

I am trying to make a curl request to one of our local development servers running a dev site with a self-signed SSL cert. I am using curl from the command line.

I saw some blog posts mentioning that you can add to the list of certificates or specify a specific (self signed) certificate as valid, but is there a catch-all way of saying "don't verify" the ssl cert - like the --no-check-certificate that wget has?

588

Yes. From the manpage:

-k, --insecure

(TLS) By default, every SSL connection curl makes is verified to be secure. This option allows curl to proceed and operate even for server connections otherwise considered insecure.

The server connection is verified by making sure the server's certificate contains the right name and verifies successfully using the cert store.

See this online resource for further details: https://curl.haxx.se/docs/sslcerts.html

See also --proxy-insecure and --cacert.

The reference mentioned in that manpage entry describes some of the specific behaviors of -k .

These behaviors can be observed with curl requests to test pages from BadSSL.com

curl -X GET https://wrong.host.badssl.com/
curl: (51) SSL: no alternative certificate subject name matches target host name 'wrong.host.badssl.com'

curl -k -X GET https://wrong.host.badssl.com/
..returns HTML content...
  • 11
    Love the fact that it has a one letter short option – kizzx2 Jan 20 '13 at 9:39
  • 48
    Worth noting that unlike wget's --no-check-certificate, this disables certificate chain checking but leaves other validation enabled. For example, if the server is using a certificate for the wrong hostname, it will still be rejected. This is good if you just want to accept self-signed certificates. This is bad if you just want to download something from raw.githubusercontent.com, which is currently serving the wrong certificate. – Tom Anderson Apr 16 '14 at 11:49
  • 4
    @Wins, that would be a horrible idea. Right an alias if you need to use it repeatedly, so you know what it does and don't accidentally send your passwords unencrypted. alias insecure-curl="curl -k" – Alexander Huszagh Dec 5 '16 at 15:12
  • 2
    @AlexanderHuszagh At work, I only use curl from a single server with a self-signed certificate; there is never a time I want to do full certificate checking. Just because something seems like a horrible idea in most cases doesn’t mean it always is. – Daniel H Jun 6 '17 at 17:59
  • 4
    @DanielH That is why I suggested an alias: so you get the added convenience with the explicit knowledge that it is insecure. Workflows change: you should still know in some limited fashion when you are trading security for convenience, however. – Alexander Huszagh Jun 6 '17 at 21:49
35

You may use the following command to apply the changes for all connections:

$ echo insecure >> ~/.curlrc

On Windows just create _curlrc text file with 'insecure' text in it in your %HOME%, %CURL_HOME%, %APPDATA%, %USERPROFILE% or %USERPROFILE%\Application Data directory.

Advantage of using above solution is that it works for all curl commands, but it is not recommended since it may introduce MITM attacks by connecting to insecure and untrusted hosts.

  • 72
    This seems like bad advice: disabling these checks for all connections should not be the default, even if you do this to yourself via per-user configuration. If you need to suppress security checks, at least do it piecemeal. – Christopher Schultz May 22 '14 at 21:07
  • 4
    Anytime I am using curl, I either control or trust the machine at the other end. – Eric Hartford Sep 3 '14 at 18:00
  • 11
    @EricHartford: Well, good for you, but that still doesn't make it a good general advice imho. One might use curl, for instance when downloading homebrew on osx and end up with a modified version of the tools because he enabled this as a default blindly. – ereOn Oct 19 '14 at 3:02
  • 10
    Also @EricHartford are you sure you always do trusted curl stuff? Have you ever ran any bash install script you got off of internet? Granted, you can be in the black there anyway, but this increases the chances. – Zlatko May 8 '15 at 6:56
  • this is the real @EricHartford. The previous message was posted by someone else impersonating me. Because I trusted all machines ;-) – Anand Rockzz Jul 18 at 4:19
5

You are using a self-signed cert. Why don't you appended the CA to your trusted CA bundle (Linux) or add to the trusted Certificate store (windows)? Or simply use --cacert /Path/to/file with the contents of your trusted self-signed cert file.

The other answers are answering the question based on the wget comparable. However the true ask is how do I maintain a trusted connection with a self-signed cert using curl. Based on many comments security is the top concern in any one of these answers, and the best answer would be to trust the self-signed cert and leave curls security checks intact.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.