GNURLOPT_PROXY_SSL_VERIFYHOST(3)

💖 GNURLOPT_PROXY_SSL_VERIFYHOST(3) 💖

okay so this page lives in the curl_easy_setopt options manual, and it's all about making sure your HTTPS proxy is actually your proxy and not some random certificate in a trench coat. The title vibe is GNURLOPT_PROXY_SSL_VERIFYHOST(3) — full name on the heading, abbreviated little gremlin in the footer, we'll get there. 💅

---

🌸 NAME 🌸

CURLOPT_PROXY_SSL_VERIFYHOST — verify the proxy certificate's name against host. That's the name, bestie: it checks the proxy cert's name against the host. Slay? It's giving safety feature.

✨ SYNOPSIS ✨

#include <gnurl/curl.h>

CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_SSL_VERIFYHOST,
long verify);

🦋 DESCRIPTION 🦋

You pass a long set to 2L, and that's you asking curl to verify the HTTPS proxy's certificate name fields against the proxy name. Yes, 2L, not vibes. ✨

This option determines whether libcurl verifies that the proxy cert contains the correct name for the name it is known as.

When CURLOPT_PROXY_SSL_VERIFYHOST(3) is 2, the proxy certificate must indicate that the server is the proxy to which you meant to connect to, or the connection fails. no cap: if it doesn't match up, the connection is not happening.

Curl considers the proxy the intended one when the Common Name field or a Subject Alternate Name field in the certificate matches the host name in the proxy string which you told curl to use. That's the match-up, that's the moment. 🫶

If verify value is set to 1, here's the timeline tea:

• In 7.28.0 and earlier: treated as a debug option of some sorts, not supported anymore due to frequently leading to programmer mistakes.
• From 7.28.1 to 7.65.3: setting it to 1 made curl_easy_setopt() return an error and leaving the flag untouched.
• From 7.66.0: treats 1 and 2 the same.

When the verify value is 0L, the connection succeeds regardless of the names used in the certificate. Use that ability with caution!

🚨 caution alert: 0L means the name check is off — the original page literally says "Use that ability with caution!" so I'm passing that warning straight to you, bestie.

See also CURLOPT_PROXY_SSL_VERIFYPEER(3) to verify the digital signature of the proxy certificate. If libcurl is built against NSS and CURLOPT_PROXY_SSL_VERIFYPEER(3) is zero, CURLOPT_PROXY_SSL_VERIFYHOST(3) is also set to zero and cannot be overridden.

🎀 DEFAULT 🎀

2

That's the default. No notes, it's just 2. 💖

🌈 PROTOCOLS 🌈

All protocols when used over an HTTPS proxy. Periodt.

🔥 EXAMPLE 🔥

CURL *curl = curl_easy_init();
if(curl) {
  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");

  /* Set the default value: strict name check please */
  curl_easy_setopt(curl, CURLOPT_PROXY_SSL_VERIFYHOST, 2L);

  curl_easy_perform(curl);
}

⭐ AVAILABILITY ⭐

Added in 7.52.0.

If built TLS enabled. (Yes, that's the phrasing from the page, we keep it exactly. 💀)

🧚 RETURN VALUE 🧚

Returns CURLE_OK if TLS is supported, and CURLE_UNKNOWN_OPTION if not.

If 1 is set as argument, CURLE_BAD_FUNCTION_ARGUMENT is returned.

👑 SEE ALSO 👑

• CURLOPT_PROXY_SSL_VERIFYPEER(3)
• CURLOPT_PROXY_CAINFO(3)
• CURLOPT_SSL_VERIFYPEER(3)
• CURLOPT_CAINFO(3),

mwah 💋 okay that's the page: source/version libcurl 7.52.0, date 16 Nov 2016, and the footer line says GNURLOPT_P..._VERIFYHOST(3). She's iconic, she's verifying proxy names, she's done. 💖