if I write a https program with libcurl, which CA cert should I download?

问题

I write a program to verify this website:

www.alipay.com

which root CA cert should I download from VeriSign, Inc.?

回答1:

You can use this one:

https://knowledge.rapidssl.com/library/VERISIGN/ALL_OTHER/RapidSSL%20Intermediate/RapidSSL_CA_bundle.pem

Or this one from mozilla:

https://mxr.mozilla.org/mozilla/source/security/nss/lib/ckfw/builtins/certdata.txt?raw=1

回答2:

The curl project itself provides the Mozilla bundle converted to PEM if you'd like that:

http://curl.haxx.se/docs/caextract.html

来源：https://stackoverflow.com/questions/9986572/if-i-write-a-https-program-with-libcurl-which-ca-cert-should-i-download