CURLOPT_PROXY_CAINFO(3)

💖 NAME 💖

okay so this is CURLOPT_PROXY_CAINFO(3) from libcurl — the manual page for the path to your proxy Certificate Authority (CA) bundle, bestie. It’s giving “where do I find the certs to verify my HTTPS proxy?” energy, and we’re obsessed. 💅

---

✨ SYNOPSIS ✨

#include <curl/curl.h>

CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_CAINFO, char *path);

---

🦋 DESCRIPTION 🦋

okay so first thing: this option is for connecting to an HTTPS proxy, not an HTTPS server. Important distinction, no cap. 🫶

You pass a char pointer to a null-terminated string naming a file that holds one or more certificates, and those certs are what you use to verify the HTTPS proxy. Slay. ✨

Now, if CURLOPT_PROXY_SSL_VERIFYPEER(3) is zero and you’re avoiding verifying the server’s certificate, then CURLOPT_PROXY_CAINFO(3) doesn’t even need to indicate an accessible file. Lowkey wild, but that’s the deal. 💀

By default, this option is set to the system path where libcurl’s CA certificate bundle is assumed to be stored — as established at build time. Built-in system path vibes, periodt. 🌸

The application does not have to keep the string around after setting this option. So you can free that memory, bestie, it’s fine. 🧚

Using this option multiple times makes the last set string override the previous ones. Set it to NULL to disable its use again and switch back to the internal default. Main character override behavior, honestly. 👑

And if you’re wondering what the default value actually is, you can figure it out with CURLINFO_CAINFO(3). iykyk. 🔥

---

🎀 DEFAULT 🎀

Built-in system specific. That’s the whole mood. 🎀

---

🌈 PROTOCOLS 🌈

This functionality affects all TLS based protocols:

• HTTPS
• FTPS
• IMAPS
• POP3S
• SMTPS
• etc.

All TLS backends support this option. Every single one. Slay. 💅

---

🍓 EXAMPLE 🍓

here’s the code, bestie — copied exactly, no edits, because we don’t play with code blocks:

int main(void)
{
  CURL *curl = curl_easy_init();
  if(curl) {
    CURLcode result;
    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
    /* using an HTTPS proxy */
    curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy.example:443");
    curl_easy_setopt(curl, CURLOPT_PROXY_CAINFO, "/etc/certs/cabundle.pem");
    result = curl_easy_perform(curl);
    curl_easy_cleanup(curl);
  }
}

---

💀 NOTES 💀

For TLS backends that do not support certificate files, the CURLOPT_PROXY_CAINFO(3) option is ignored. Not me finding out the hard way 😭 — refer to https://curl.se/docs/ssl-compared.html for the deets.

---

⭐ AVAILABILITY ⭐

Added in curl 7.52.0. iconic behavior since way back. ⭐

---

🧚 RETURN VALUE 🧚

curl_easy_setopt(3) returns a CURLcode indicating success or error. Simple as that. 🌸

CURLE_OK (0) means everything was OK. Non-zero means an error occurred — see libcurl-errors(3) for the full tea. ☕

---

👑 SEE ALSO 👑

• CURLOPT_CAINFO(3)
• CURLOPT_CAINFO_BLOB(3)
• CURLOPT_CAPATH(3)
• CURLOPT_PROXY_CAINFO_BLOB(3)
• CURLOPT_PROXY_CAPATH(3)
• CURLOPT_PROXY_SSL_VERIFYHOST(3)
• CURLOPT_PROXY_SSL_VERIFYPEER(3)
• CURLOPT_SSL_VERIFYHOST(3)
• CURLOPT_SSL_VERIFYPEER(3)

---

Signed, sealed, and delivered by libcurl on 2026-10-12 — CURLOPT_PROXY_CAINFO(3) out 💅✨