3

I cant tell the difference or when to use one over the other. (Should this be on serverfault?)

-E/--cert

(SSL) Tells curl to use the specified certificate file when getting a file with HTTPS or FTPS. The certificate must be in PEM format. If the optional password isn't specified, it will be queried for on the terminal. Note that this option assumes a "certificate" file that is the private key and the private certificate concatenated! See --cert and --key to specify them independently.

If curl is built against the NSS SSL library then this option tells curl the nickname of the certificate to use within the NSS database defined by the environment variable SSL_DIR (or by default /etc/pki/nssdb). If the NSS PEM PKCS#11 module (libnsspem.so) is available then PEM files may be loaded.

If this option is used several times, the last one will be used.

--cert-type

and

--cacert

(SSL) Tells curl to use the specified certificate file to verify the peer. The file may contain multiple CA certificates. The certificate(s) must be in PEM format. Normally curl is built to use a default file for this, so this option is typically used to alter that default file.

curl recognizes the environment variable named 'CURL_CA_BUNDLE' if it is set, and uses the given path as a path to a CA cert bundle. This option overrides that variable.

The windows version of curl will automatically look for a CA certs file named ´curl-ca-bundle.crt´, either in the same directory as curl.exe, or in the Current Working Directory, or in any folder along your PATH.

If curl is built against the NSS SSL library then this option tells curl the nickname of the CA certificate to use within the NSS database defined by the environment variable SSL_DIR (or by default /etc/pki/nssdb). If the NSS PEM PKCS#11 module (libnsspem.so) is available then PEM files may be loaded.

If this option is used several times, the last one will be used.

2 Answers2

3

-E is used to present a client cert to the server. --cacert is used to verify the server cert.

EDIT:

SSL itself serves 3 purposes:

  1. Encrypt the connection.
  2. Authenticate the server.
  3. (optional) Authenticate the client.

Most people think of SSL as only point 1, although point 2 is true if everything is in place. Only when there's some sort of cert problem do people actively consider point 2. Almost no one considers point 3, since it's used far more rarely.

--cacert deals with point 2. -E deals with point 3.

Ignacio Vazquez-Abrams
  • 112,653
  • Darn! You beat me by 30 seconds. Do I delete my answer? Or just let the votes take care of it? – Jed Daniels Jul 19 '10 at 05:31
  • 1
    Leave it. (15 chars) – TheLQ Jul 19 '10 at 05:36
  • So your saying servers can throw an error saying i am not authenticated!?! i had no idea. And -E is my cert as the client. I had no idea that was possible and the text in the man page did not give me a good enough hint that is what it does. wow. –  Jul 19 '10 at 19:29
  • Try logging in here for an example: http://koji.fedoraproject.org/koji/ – Ignacio Vazquez-Abrams Jul 19 '10 at 20:39
2

-E/--Cert is used to authenticate the client (you).

--cacert is used to very the server is who they claim to be.

Jed Daniels
  • 1,214