curl https://baidu.com -v # 输出 * Rebuilt URL to: https://baidu.com/ * Trying 39.156.69.79... * Connected to baidu.com (39.156.69.79) port 443 (#0) * found 148 certificates in /etc/ssl/certs/ca-certificates.crt * found 592 certificates in /etc/ssl/certs * ALPN, offering http/1.1 * SSL connection using TLS1.2 / ECDHE_RSA_AES_128_GCM_SHA256 * server certificate verification OK * server certificate status verification SKIPPED * common name: www.baidu.cn (matched) * server certificate expiration date OK * server certificate activation date OK * certificate public key: RSA * certificate version: #3 * subject: C=CN,ST=Beijing,O=BeiJing Baidu Netcom Science Technology Co.\, Ltd,OU=service operation department,CN=www.baidu.cn * start date: Thu, 27 Feb 2020 00:00:00 GMT * expire date: Fri, 26 Feb 2021 12:00:00 GMT * issuer: C=US,O=DigiCert Inc,CN=DigiCert SHA2 Secure Server CA * compression: NULL * ALPN, server accepted to use http/1.1 # ....
关注重点信息:
1 2
* found 148 certificates in /etc/ssl/certs/ca-certificates.crt * found 592 certificates in /etc/ssl/certs
--cacert <CA certificate> (SSL) Tells curl to use the specified certificate file to verify the peer. The file may contain multiple CA certificates. The cer‐ tificate(s) must be in PEM format. Normally curl is built to use a default file for this, so this option is typically used to alter that default file. curl recognizes the environment variable named 'CURL_CA_BUNDLE'if it is set, and uses the given path as a path to a CA cert bundle. This option overrides that variable. The windows version of curl will automatically look for a CA certs file named ´curl-ca-bundle.crt´, either in the same directory as curl.exe, or in the Current Working Directory, or in any folder along your PATH. If curl is built against the NSS SSL library, the NSS PEM PKCS#11 module (libnsspem.so) needs to be available for this option to work properly. If this option is used several times, the last one will be used.
1 2 3 4 5 6
--capath <CA certificate directory> (SSL) Tells curl to use the specified certificate directory to verify the peer. Multiple paths can be provided by separating them with ":" (e.g. "path1:path2:path3"). The certificates must be in PEM format, and if curl is built against OpenSSL, the directory must have been processed using the c_rehash utility supplied with OpenSSL. Using --capath can allow OpenSSL-powered curl to make SSL- connections much more efficiently than using --cacert if the --cacert file contains many CA certificates. If this option is set, the default capath value will be ignored, and if it is used several times, the last one will be used.
ca-certificates
ca-certificates则是一个包, 用于维护根证书库, 所有的 CA 根证书实际上是由 Mozilla 维护的
可以通过dpkg -L ca-certificates来查看证书相关信息
也可以通过apt-cache show ca-certificates 查看相关信息，当然太多，看不出什么来,就是一堆证书
