| 1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950 |
- Short: E
- Long: cert
- Arg: <certificate[:password]>
- Help: Client certificate file and password
- Protocols: TLS
- See-also: cert-type key key-type
- ---
- Tells curl to use the specified client certificate file when getting a file
- with HTTPS, FTPS or another SSL-based protocol. The certificate must be in
- PKCS#12 format if using Secure Transport, or PEM format if using any other
- engine. If the optional password isn't specified, it will be queried for on
- the terminal. Note that this option assumes a \&"certificate" file that is the
- private key and the client certificate concatenated! See --cert and --key to
- specify them independently.
- If curl is built against the NSS SSL library then this option can tell
- curl the nickname of the certificate to use within the NSS database defined
- by the environment variable SSL_DIR (or by default /etc/pki/nssdb). If the
- NSS PEM PKCS#11 module (libnsspem.so) is available then PEM files may be
- loaded. If you want to use a file from the current directory, please precede
- it with "./" prefix, in order to avoid confusion with a nickname. If the
- nickname contains ":", it needs to be preceded by "\\" so that it is not
- recognized as password delimiter. If the nickname contains "\\", it needs to
- be escaped as "\\\\" so that it is not recognized as an escape character.
- If curl is built against OpenSSL library, and the engine pkcs11 is available,
- then a PKCS#11 URI (RFC 7512) can be used to specify a certificate located in
- a PKCS#11 device. A string beginning with "pkcs11:" will be interpreted as a
- PKCS#11 URI. If a PKCS#11 URI is provided, then the --engine option will be set
- as "pkcs11" if none was provided and the --cert-type option will be set as
- "ENG" if none was provided.
- (iOS and macOS only) If curl is built against Secure Transport, then the
- certificate string can either be the name of a certificate/private key in the
- system or user keychain, or the path to a PKCS#12-encoded certificate and
- private key. If you want to use a file from the current directory, please
- precede it with "./" prefix, in order to avoid confusion with a nickname.
- (Schannel/WinSSL only) Client certificates must be specified by a path
- expression to a certificate store. (Loading PFX is not supported; you can
- import it to a store first). You can use
- "<store location>\\<store name>\\<thumbprint>" to refer to a certificate
- in the system certificates store, for example,
- "CurrentUser\\MY\\934a7ac6f8a5d579285a74fa61e19f23ddfe8d7a". Thumbprint is
- usually a SHA-1 hex string which you can see in certificate details. Following
- store locations are supported: CurrentUser, LocalMachine, CurrentService,
- Services, CurrentUserGroupPolicy, LocalMachineGroupPolicy,
- LocalMachineEnterprise.
- If this option is used several times, the last one will be used.
|
