CURLOPT_CRLFILE(3)

✨ CURLOPT_CRLFILE(3) ✨

okay so welcome to the CURLOPT_CRLFILE(3) page, straight out of the Library Functions Manual 💅 this is the libcurl manual and we're about to talk about Certificate Revocation List files. no cap, it's giving secure TLS energy 🎀

💖 NAME 💖

CURLOPT_CRLFILE — Certificate Revocation List file. literally the option for telling curl where your CRL file lives, bestie 🦋

🌸 SYNOPSIS 🌸

#include <curl/curl.h>

CURLcode curl_easy_setopt(CURL *handle, CURLOPT_CRLFILE, char *file);

🦋 DESCRIPTION 🦋

okay so you pass a char pointer to a null-terminated string naming a file with the concatenation of CRL (in PEM format) to use in the certificate validation that occurs during the SSL exchange. that's the whole vibe: CRL file, PEM format, SSL exchange, certificate validation ✨

backend tea, because it matters:

• GnuTLS: when curl is built to use GnuTLS, there is no way to influence the use of CRL passed to help in the verification process. so yeah, that's a thing 😭
• OpenSSL: when libcurl is built with OpenSSL support, X509_V_FLAG_CRL_CHECK and X509_V_FLAG_CRL_CHECK_ALL are both set, requiring CRL check against all the elements of the certificate chain if a CRL file is passed. also note that CURLOPT_CRLFILE(3) implies CURLSSLOPT_NO_PARTIALCHAIN (see CURLOPT_SSL_OPTIONS(3)) since curl 7.71.0 due to an OpenSSL bug.

this option makes sense only when used in combination with the CURLOPT_SSL_VERIFYPEER(3) option. like, that's its whole main character pairing 🔥

a specific error code (CURLE_SSL_CRL_BADFILE) is defined with the option. it is returned when the SSL exchange fails because the CRL file cannot be loaded. a failure in certificate verification due to revocation information found in the CRL does not trigger this specific error. so don't blame this error for every CRL-related heartbreak, okay? 💀

the application does not have to keep the string around after setting this option. set it and forget it, bestie 🫶

using this option multiple times makes the last set string override the previous ones. set it to NULL to disable its use again. periodt.

🎀 DEFAULT 🎀

NULL — the default is literally NULL, no cap.

🌈 PROTOCOLS 🌈

this functionality affects all TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc. so many S's, iykyk 😌

this option works only with the following TLS backends: GnuTLS, OpenSSL, Rustls and mbedTLS. those are the backend besties that get it 💅

🌟 EXAMPLE 🌟

here's the example, bestie:

int main(void)
{
  CURL *curl = curl_easy_init();
  if(curl) {
    CURLcode result;
    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
    curl_easy_setopt(curl, CURLOPT_CRLFILE, "/etc/certs/crl.pem");
    result = curl_easy_perform(curl);
    curl_easy_cleanup(curl);
  }
}

🦄 AVAILABILITY 🦄

added in curl 7.19.0. iconic since way back, ngl ⭐

💜 RETURN VALUE 💜

curl_easy_setopt(3) returns a CURLcode indicating success or error.

CURLE_OK (0) means everything was OK, non-zero means an error occurred, see libcurl-errors(3). so vibe check that return code, fr fr 🧚

👑 SEE ALSO 👑

• CURLOPT_PROXY_CRLFILE(3)
• CURLOPT_SSL_VERIFYHOST(3)
• CURLOPT_SSL_VERIFYPEER(3)

---

💖 that's the whole page! brought to you by libcurl, dated 2026-10-12, and titled CURLOPT_CRLFILE(3) — bye bestie, stay secure and slay 🫶✨