CURLOPT_CA_CACHE_TIMEOUT(3)

💅 CURLOPT_CA_CACHE_TIMEOUT(3) — like, the whole glow-up guide

okay bestie, welcome to the Library Functions Manual, pull up a chair, we're talking about CURLOPT_CA_CACHE_TIMEOUT and honestly? it's giving "unsung hero of your TLS handshakes" ✨

🌸 NAME 🌸

CURLOPT_CA_CACHE_TIMEOUT — the life-time for cached certificate stores. yes queen, it's literally the expiration date on libcurl's memory of your CA certs 🎀

✨ SYNOPSIS ✨

#include <curl/curl.h>

CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CA_CACHE_TIMEOUT, long age);

💖 DESCRIPTION 💖

so you pass a long, right? and that's your timeout in seconds. what it's telling libcurl is: this is the maximum time any cached CA certificate store it's holding in memory may be kept and reused for new connections. once that timeout has expired, a subsequent fetch that needs a CA certificate has to go reload it. no shortcuts, no leftovers, periodt 💅

building a CA certificate store from a CURLOPT_CAINFO(3) file is a slow operation (like, painfully slow, an actual vibe killer 😭) so curl may cache the generated certificate store internally to speed up future connections. iconic behavior honestly.

now the important bits, don't skip these:

• set the timeout to zero to completely disable caching (no cache, no crumbs)
• set it to -1 to retain the cached store forever (forever-ever 🔥)
• by default, libcurl caches this info for 24 hours

🦋 DEFAULT 🦋

86400 (24 hours) — that's the factory setting bb, no cap ⭐

🌈 PROTOCOLS 🌈

this functionality affects all TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc. all of them. the whole squad 🫶

heads up though: this option works only with the following TLS backends: GnuTLS, OpenSSL, Schannel and wolfSSL. if your backend isn't on the list, this option is lowkey just not the moment 💀

🎀 EXAMPLE 🎀

ok so here's the little demo, keep it exactly as is:

int main(void)
{
  CURL *curl = curl_easy_init();
  if(curl) {
    CURLcode res;
    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/foo.bin");

    /* only reuse certificate stores for a short time */
    curl_easy_setopt(curl, CURLOPT_CA_CACHE_TIMEOUT, 60L);

    res = curl_easy_perform(curl);

    /* in this second request, the cache is not used if more than
       sixty seconds passed since the previous connection */
    res = curl_easy_perform(curl);

    curl_easy_cleanup(curl);
  }
}

see how that works? sixty seconds and the cache is like "mmm I'm out" 🙈

🧚 HISTORY 🧚

this option is supported by:

• OpenSSL and its forks — since 7.87.0
• Schannel — since 8.5.0
• wolfSSL — since 8.9.0
• GnuTLS — since 8.9.0

look at them all arriving fashionably late to the party, we love a staggered rollout 👑

💜 AVAILABILITY 💜

added in curl 7.87.0 — she's not ancient, she's vintage ✨

⭐ RETURN VALUE ⭐

curl_easy_setopt(3) returns a CURLcode indicating success or error.

CURLE_OK (0) means everything was OK. non-zero means an error occurred — go check libcurl-errors(3) and don't come for me about it 😌

🔥 SEE ALSO 🔥

• CURLOPT_CAINFO(3)
• CURLOPT_CAINFO_BLOB(3)
• CURLOPT_CAPATH(3)
• CURLOPT_SSL_VERIFYHOST(3)
• CURLOPT_SSL_VERIFYPEER(3)

---

okay that's the whole page, you ate that fr fr 💅 this lil number lives in libcurl, dated 2026-10-12, filed under CURLOPT_CA_CACHE_TIMEOUT(3) — mwah, go forth and cache responsibly 🍓💖