I'm using cURL to fetch from an HTTPS location, which requires a client certificate. I have my .curlrc set up to tell cURL where it is, but I don't want to leave my unencrypted private key just lying around. So every time I use it, cURL prompts me for the certificate password.

A lot of other utilities hook into some kind of platform-specific keyring (the native one in OSX, gnome-keyring in Linux, etc) -- is there a hook like this for cURL? Is there any other way to have cURL get my private key on a per-shell / per-session basis rather than prompting every time?

  • If on Linux, you could keep the keys in an encrypted filesystem such as eCryptFS. – user1686 Jan 5 '12 at 16:05

Private keys stored in GNOME Keyring (not key passwords, but the keys themselves) can be accessed using a standard PKCS#11 interface, preferably through p11-kit (pkcs11 module libp11-kit.so). This can be used from various programs.

However, curl unfortunately does not appear to support PKCS11 modules, even though the OpenSSL library itself is able to use them. This might have something to do with some distros building curl with GnuTLS or NSS instead...

  • Well, poop. Is there another command-line fetch utility that plays nice with keyrings? I'm not married to cURL, I just need to grab a file off HTTPS in a script, from a site that requires client auth. – Coderer Jan 5 '12 at 15:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.