SSL_OPTIONS: set SSL options on Curl library #3936
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I would like to suggest a build-time option for adjusting Curl SSL options on PROJ. The default Curl SSL options appear to be more pedantic on certificate revocation checks than web browsers are. It could be discussed, if fail-hard checking is needed, when grid data downloads are concerned. See https://en.wikipedia.org/wiki/Certificate_revocation for some general info.
PROJ has the environment variable PROJ_UNSAFE_SSL for turning off all SSL checks. However, I would like to be able to use CURLSSLOPT_NO_REVOKE option in some environments, and keep all the other SSL checks enabled.
After the code change suggested in this pull request, CURLSSLOPT_NO_REVOKE could be selected at build-time by this kind of addition to PROJ cmake command:
-DCMAKE_CXX_FLAGS="-DSSL_OPTIONS=2"
Curl SSL options are described in https://curl.se/libcurl/c/CURLOPT_SSL_OPTIONS.html
docs/source/*.rst
for new API