05-19-2010
It worked fine for me and I was using IP addresses. By the way, the documentation doesn't states a hostname must be used when TLS is enabled, only that there should be a full match between what is in the certificate and what is in the name service (hosts or dns).
10 More Discussions You Might Find Interesting
1. UNIX for Advanced & Expert Users
I am confused in understanding, how ldap authentication works. Anyone has any idea ? I also want to know when you create certificate where does openldap stores certificate information.
$nilesh (1 Reply)
Discussion started by: ynilesh
1 Replies
2. Emergency UNIX and Linux Support
Today when someone was using Sun Identity Manager to modify a directory managed by Sun Directory Server Enterprise Edition (DSEE 6.3) IDM spit out an object class violation error (I verified that the input data was valid). It also corrupted the directory to the point where I can't even get dsadm to... (7 Replies)
Discussion started by: ilikecows
7 Replies
3. UNIX for Dummies Questions & Answers
hi guys
I configured my openldap but now I want to implement SSL-TLS
This is my basic slapd.conf configuration
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/inetorgperson.schema
include ... (2 Replies)
Discussion started by: karlochacon
2 Replies
4. UNIX for Advanced & Expert Users
Hey Guys,
I am trying to setup ldap over tls in our lab. I am generating a self signed cert on the ldap server and importing that into the ldap system so it will use ldap over port 636. The clients will be a mix of solaris and redhat. I am lost on what I need to do on the client side to get... (0 Replies)
Discussion started by: s ladd
0 Replies
5. Cybersecurity
Hey Guys,
I have a couple servers that are getting flagged by by our network security team. How do I disable TLS 1.0 protocol within Solaris? The vulnerability is :
CVE-2011-3389
TLS-SSL Server Blockwise Chosen-Boundary Browser Weakness (2 Replies)
Discussion started by: s ladd
2 Replies
6. UNIX for Advanced & Expert Users
Hello to all,
I'm beguinner in Linux instalations and I'm trying to Communicate from Web Sites that i have running under apache with openLDAP for users authentication using SSL mediation that seems to be connected with LDAPS.
Can someone advise me how to do this, I have already installed... (1 Reply)
Discussion started by: CPMarco
1 Replies
7. UNIX for Advanced & Expert Users
Here are the essentials:
un: myuser
pw: mypasswd
site: sftp.somesite.com
port: 990
type: FTPS
enc: FTP over implicit TLS
program used:
Curl 7.1.x on Hpux 11.31
I would like to "put" 1 file on there server.
Here is my syntax, what am I doing wrong?
curl -3 -v --cacert... (4 Replies)
Discussion started by: olyanderson
4 Replies
8. HP-UX
We are running HP-UX 11v1 and are about to upgrade sendmail to 8.13.3 to allow support for TLS. Enabling TLS seems pretty straightforward, but I'm wondering if an SSL certificate is required for this. Our MS Exchange server does use a certificate. Do I need to arrange for a public certificate to... (3 Replies)
Discussion started by: jduehmig
3 Replies
9. AIX
The situation
Version AIX7.1/8.14.4
Compiled with: DNSMAP LDAPMAP LDAP_REFERRALS LOG MAP_REGEX MATCHGECOS
MILTER MIME7TO8 MIME8TO7 NAMED_BIND NDBM NETINET NETINET6
NETUNIX NEWDB NIS NISPLUS PIPELINING SCANF STARTTLS USERDB
USE_LDAP_INIT XDEBUG... (2 Replies)
Discussion started by: Linusolaradm1
2 Replies
10. Solaris
We are implementing CUPS on a new Solaris 11.3 system. The same system will run an application where users can print to networked printers inside our organisation, or to a printer outside of our organisation over the internet.
For users printing to internal network printers, no encryption is... (0 Replies)
Discussion started by: SallyB
0 Replies
LEARN ABOUT MOJAVE
curlopt_proxy_ssl_verifypeer
CURLOPT_PROXY_SSL_VERIFYPEER(3) curl_easy_setopt options CURLOPT_PROXY_SSL_VERIFYPEER(3)
NAME
CURLOPT_PROXY_SSL_VERIFYPEER - verify the proxy's SSL certificate
SYNOPSIS
#include <curl/curl.h>
CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_SSL_VERIFYPEER, long verify);
DESCRIPTION
Pass a long as parameter set to 1L to enable or 0L to disable.
This option tells curl to verifies the authenticity of the HTTPS proxy's certificate. A value of 1 means curl verifies; 0 (zero) means it
doesn't.
This is the proxy version of CURLOPT_SSL_VERIFYPEER(3) that's used for ordinary HTTPS servers.
When negotiating a TLS or SSL connection, the server sends a certificate indicating its identity. Curl verifies whether the certificate is
authentic, i.e. that you can trust that the server is who the certificate says it is. This trust is based on a chain of digital signa-
tures, rooted in certification authority (CA) certificates you supply. curl uses a default bundle of CA certificates (the path for that is
determined at build time) and you can specify alternate certificates with the CURLOPT_PROXY_CAINFO(3) option or the CURLOPT_PROXY_CAPATH(3)
option.
When CURLOPT_PROXY_SSL_VERIFYPEER(3) is enabled, and the verification fails to prove that the certificate is authentic, the connection
fails. When the option is zero, the peer certificate verification succeeds regardless.
Authenticating the certificate is not enough to be sure about the server. You typically also want to ensure that the server is the server
you mean to be talking to. Use CURLOPT_PROXY_SSL_VERIFYHOST(3) for that. The check that the host name in the certificate is valid for the
host name you're connecting to is done independently of the CURLOPT_PROXY_SSL_VERIFYPEER(3) option.
WARNING: disabling verification of the certificate allows bad guys to man-in-the-middle the communication without you knowing it. Disabling
verification makes the communication insecure. Just having encryption on a transfer is not enough as you cannot be sure that you are commu-
nicating with the correct end-point.
DEFAULT
1
PROTOCOLS
All
EXAMPLE
CURL *curl = curl_easy_init();
if(curl) {
curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
/* Set the default value: strict certificate check please */
curl_easy_setopt(curl, CURLOPT_PROXY_SSL_VERIFYPEER, 1L);
curl_easy_perform(curl);
}
AVAILABILITY
Added in 7.52.0
If built TLS enabled.
RETURN VALUE
Returns CURLE_OK if the option is supported, and CURLE_UNKNOWN_OPTION if not.
SEE ALSO
CURLOPT_PROXY_SSL_VERIFYHOST(3), CURLOPT_SSL_VERIFYPEER(3), CURLOPT_SSL_VERIFYHOST(3),
libcurl 7.54.0 December 16, 2016 CURLOPT_PROXY_SSL_VERIFYPEER(3)