CURLINFO_TLS_SESSION: SSL_CTX *
CURLINFO_TLS_SSL_PTR: SSL *
axTLS SSL * mbedTLS mbedtls_ssl_session * PolarSSL ssl_session * Secure Channel (WinSSL) CtxtHandle * Secure Transport (DarwinSSL) SSLContext * WolfSSL (formerly CyaSSL) SSL *
If the internals pointer is NULL then either the SSL backend is not supported or an SSL session has not yet been established.
This option has some limitations that could make it unsafe when it comes to the manual verification of certificates.
This option only retrieves the first in-use SSL session pointer for your easy handle, however your easy handle may have more than one in-use SSL session if using FTP over SSL. That is because the FTP protocol has a control channel and a data channel and one or both may be over SSL. Currently there is no way to retrieve a second in-use SSL session associated with an easy handle.
This option has not been thoroughly tested with plaintext protocols that can be upgraded/downgraded to/from SSL: FTP, SMTP, POP3, IMAP when used with CURLOPT_USE_SSL(3). Though you will be able to retrieve the SSL pointer, its possible that before you can do that data (including auth) may have already been sent over a connection after it was upgraded.
Renegotiation. If unsafe renegotiation or renegotiation in a way that the certificate is allowed to change is allowed by your SSL library this may occur and the certificate may change, and data may continue to be sent or received after renegotiation but before you are able to get the (possibly) changed SSL pointer, with the (possibly) changed certificate information.
If you are using OpenSSL or wolfSSL then CURLOPT_SSL_CTX_FUNCTION(3) can be used to set a certificate verification callback in the CTX. That is safer than using this option to poll for certificate changes and doesnt suffer from any of the problems above. There is currently no way in libcurl to set a verification callback for the other SSL backends.
How are you using this option? Are you affected by any of these limitations? Please let us know by making a comment at https://github.com/curl/curl/issues/685
Added in 7.48.0.
This option supersedes CURLINFO_TLS_SESSION(3) which was added in 7.34.0. This option is exactly the same as that option except in the case of OpenSSL.
Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
|libcurl 7.48.0||CURLINFO_TLS_SSL_PTR (3)||23 Feb 2016|