Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using cURL to fetch from an HTTPS location, which requires a client certificate. I have my .curlrc set up to tell cURL where it is, but I don't want to leave my unencrypted private key just lying around. So every time I use it, cURL prompts me for the certificate password.

A lot of other utilities hook into some kind of platform-specific keyring (the native one in OSX, gnome-keyring in Linux, etc) -- is there a hook like this for cURL? Is there any other way to have cURL get my private key on a per-shell / per-session basis rather than prompting every time?

share|improve this question
If on Linux, you could keep the keys in an encrypted filesystem such as eCryptFS. – grawity Jan 5 '12 at 16:05
up vote 1 down vote accepted

Private keys stored in GNOME Keyring (not key passwords, but the keys themselves) can be accessed using a standard PKCS#11 interface, preferably through p11-kit (pkcs11 module This can be used from various programs.

However, curl unfortunately does not appear to support PKCS11 modules, even though the OpenSSL library itself is able to use them. This might have something to do with some distros building curl with GnuTLS or NSS instead...

share|improve this answer
Well, poop. Is there another command-line fetch utility that plays nice with keyrings? I'm not married to cURL, I just need to grab a file off HTTPS in a script, from a site that requires client auth. – Coderer Jan 5 '12 at 15:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.