CURLOPT_SSL_VERIFYPEER(3)

💅 CURLOPT_SSL_VERIFYPEER(3) — like, the peer's SSL certificate check 💖

okay bestie, welcome to the CURLOPT_SSL_VERIFYPEER page from the Library Functions Manual — no cap, this is the one that decides whether curl actually trusts the server it's talking to. sit down, grab a lil snack, we're doing TLS trust today 🎀

---

✨ NAME ✨

CURLOPT_SSL_VERIFYPEER — verify the peer's SSL certificate 🔥

---

🌸 SYNOPSIS 🌸

#include <curl/curl.h>

CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_VERIFYPEER, long verify);

literally just pass a long, that's the whole vibe 🫶

---

🦋 DESCRIPTION 🦋

So. You pass a long as the parameter and that turns the thing on or off. iconic behavior tbh.

This option decides whether curl verifies the authenticity of the peer's certificate. A value of 1 means curl verifies 💖. 0 (zero) means it does not 🙈.

Here's the lore: when negotiating a TLS or SSL connection, the server sends a certificate that indicates its identity. curl then checks whether that certificate is authentic — i.e. that you can trust that the server is who the certificate says it is. This trust is based on a chain of digital signatures, rooted in certification authority (CA) certificates you supply. curl uses a default bundle of CA certificates (the path for that is determined at build time) and you can specify alternate certificates with the CURLOPT_CAINFO(3) option or the CURLOPT_CAPATH(3) option. king behavior honestly 👑

When CURLOPT_SSL_VERIFYPEER(3) is enabled, and the verification fails to prove that the certificate is signed by a CA, the connection fails. like, it's not gonna happen, sorry not sorry 💀

When this option is disabled (set to zero), the CA certificates are not loaded and the peer certificate verification is simply skipped. zero thoughts, head empty ✨

Authenticating the certificate is not enough to be sure about the server, tho. You typically also want to ensure that the server is the server you mean to be talking to. Use CURLOPT_SSL_VERIFYHOST(3) for that 🧚. The check that the host name in the certificate is valid for the hostname you are connecting to is done independently of the CURLOPT_SSL_VERIFYPEER(3) option — they're two separate girlies doing two separate jobs.

🚨 WARNING: disabling verification of the certificate allows bad guys to man-in-the-middle the communication without you knowing it 😭 Disabling verification makes the communication insecure. Just having encryption on a transfer is not enough as you cannot be sure that you are communicating with the correct end-point. like, encryption without identity verification is giving "locked door, unknown address" bestie 🚪💀

Also — and this is the part people forget — when libcurl uses secure protocols it trusts responses and allows for example HSTS and Alt-Svc information to be stored and used subsequently. Disabling certificate verification can make libcurl trust and use such information from malicious servers. 🫣 so yeah, it's not just one request, it's future-you's problem too.

---

🌈 DEFAULT 🌈

1 - enabled ⭐

(that's the good one, keep it 💜)

---

🎀 PROTOCOLS 🎀

This functionality affects all TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc. 🌸

All TLS backends support this option. every single one, fr fr 👑

---

💖 EXAMPLE 💖

okay here's the whole thing in action:

int main(void)
{
  CURL *curl = curl_easy_init();
  if(curl) {
    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");

    /* Set the default value: strict certificate check please */
    curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L);

    curl_easy_perform(curl);
  }
}

strict certificate check please ✨ she said what she said 💅

---

⭐ AVAILABILITY ⭐

Added in curl 7.4.2 — an elder icon, honestly 👑

---

🍓 RETURN VALUE 🍓

curl_easy_setopt(3) returns a CURLcode indicating success or error.

CURLE_OK (0) means everything was OK 😌, non-zero means an error occurred 😭 — see libcurl-errors(3) for the whole receipts list.

---

🔥 SEE ALSO 🔥

• CURLINFO_CAINFO(3)
• CURLINFO_CAPATH(3)
• CURLOPT_CAINFO(3)
• CURLOPT_PROXY_SSL_VERIFYHOST(3)
• CURLOPT_PROXY_SSL_VERIFYPEER(3)
• CURLOPT_SSL_VERIFYHOST(3)

go read them, they're all part of the same friend group 🫶

---

anyway that's the whole page, brought to you by libcurl, version/date 2026-10-12 — CURLOPT_SSL_VERIFYPEER(3) out, stay verified bestie, don't be a man-in-the-middle 💜🦋✨