SSL certificate pinning with libcurl

问题:

I'd like to know if this example is enough to provide certificate pinning with libcurl: http://curl.haxx.se/libcurl/c/cacertinmem.html

because I have found that curl also allows http://curl.haxx.se/libcurl/c/CURLOPT_PINNEDPUBLICKEY.html

Since I'll be using a self-signed certificate and only trust on it I don't know if it's truly necessary to pinn it too.

resume: Can the connection be compromised if I only add my certificate (self-signed) to the x509 certificate store like the example? do I need to add extra checks? do I need to use the CURLOPT_PINNEDPUBLICKEY option?

Thanks.

回答1:

You can find another example in the implementation of the new curl option in git 2.8 (March 2016):

See commit aeff8a6 (15 Feb 2016) by Christoph Egger (siccegge).
^{(Merged by Junio C Hamano -- gitster -- in commit e79112d, 24 Feb 2016)}

http: implement public key pinning

Add the http.pinnedpubkey configuration option for public key pinning. It allows any string supported by libcurl -- base64(sha256(pubkey)) or filename of the full public key.

If cURL does not support pinning (is too old) output a warning to the user.

The git config man page mentions:

http.pinnedpubkey:

Public key of the https service.
It may either be the filename of a PEM or DER encoded public key file or a string starting with 'sha256//' followed by the base64 encoded sha256 hash of the public key. See also libcurl 'CURLOPT_PINNEDPUBLICKEY'.
git will exit with an error if this option is set but not supported by cURL.