CURLOPT_PROXY_ISSUERCERT_BLOB(3)

💖 CURLOPT_PROXY_ISSUERCERT_BLOB(3) 💖

okay so bestie, this is a libcurl function page — it's called CURLOPT_PROXY_ISSUERCERT_BLOB and it lives in the Library Functions Manual. no cap, it's giving "serious SSL business" but I'm gonna break it down so it's actually cute and understandable. ✨

---

✨ NAME ✨

CURLOPT_PROXY_ISSUERCERT_BLOB — proxy issuer SSL certificate from memory blob, periodt. 💅

---

🦋 SYNOPSIS 🦋

#include <curl/curl.h>

CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_ISSUERCERT_BLOB,
                          struct curl_blob *blob);

---

🌸 DESCRIPTION 🌸

So here's the vibe: you pass a pointer to a curl_blob struct, and that struct contains info — literally a pointer and a size — about a memory block holding binary data of a CA certificate in PEM format. 🎀

If you set this option, an additional check against the peer certificate gets performed to verify that the issuer of the HTTPS proxy is actually the one associated with the certificate you provided in the option. This extra check is super useful in multi-level PKI where you need to enforce that the peer certificate comes from a specific branch of the tree. iykyk. 🌳

bestie listen — this option should be used in combination with CURLOPT_PROXY_SSL_VERIFYPEER(3). Otherwise, the result of the check is just not considered a failure. so like, it won't do the thing you want unless you set both. 🙈

A specific error code, CURLE_SSL_ISSUER_ERROR, is defined with this option — it gets returned if the setup of the SSL/TLS session has failed due to a mismatch with the issuer of the peer certificate. and yes, CURLOPT_PROXY_SSL_VERIFYPEER(3) has to be set too for the check to fail. 🔥

If the blob is initialized with the flags member of struct curl_blob set to CURL_BLOB_COPY, then the application does not have to keep the buffer around after setting this. iconic. 👑

Also, this option is an alternative to CURLOPT_PROXY_ISSUERCERT(3), which instead expects a filename as input. two paths, same energy. 🦋

---

🎀 DEFAULT 🎀

NULL

---

🌈 PROTOCOLS 🌈

This functionality affects all TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc. 💖

real talk: this option works only with the following TLS backends — OpenSSL. that's it. just OpenSSL. slay but also don't forget it. ⭐

---

🍓 EXAMPLE 🍓

extern char *certificateData; /* point to the data */
size_t filesize; /* size of the data */

int main(void)
{
  CURL *curl = curl_easy_init();
  if(curl) {
    CURLcode result;
    struct curl_blob blob;
    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
    /* using an HTTPS proxy */
    curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy.example:443");
    blob.data = certificateData;
    blob.len = filesize;
    blob.flags = CURL_BLOB_COPY;
    curl_easy_setopt(curl, CURLOPT_PROXY_ISSUERCERT_BLOB, &blob);
    result = curl_easy_perform(curl);
    curl_easy_cleanup(curl);
  }
}

---

💜 AVAILABILITY 💜

Added in curl 7.71.0 🫶

---

🧚 RETURN VALUE 🧚

curl_easy_setopt(3) returns a CURLcode indicating success or error. 😭

CURLE_OK (0) means everything was OK — we love that for us. non-zero means an error occurred, see libcurl-errors(3). 💀

---

👑 SEE ALSO 👑

• CURLOPT_ISSUERCERT_BLOB(3)
• CURLOPT_PROXY_SSL_VERIFYHOST(3)
• CURLOPT_PROXY_SSL_VERIFYPEER(3)
• CURLOPT_SSL_VERIFYHOST(3)
• CURLOPT_SSL_VERIFYPEER(3)

---

and that's the whole page, bestie — go forth and verify those proxy issuers with confidence. mwah. 💅✨

this cute little rewrite brought to you by libcurl, dated 2026-10-12, manual page CURLOPT_PR...ERCERT_BLOB(3) — catch you in the next one! 🦋🎀