Search…
TLS libraries
To make curl support TLS based protocols, such as HTTPS, FTPS, SMTPS, POP3S, IMAPS and more, you need to build with a third-party TLS library since curl does not implement the TLS protocol itself.
curl is written to work with a large number of TLS libraries:
  • AmiSSL
  • BearSSL
  • BoringSSL
  • GnuTLS
  • GSKit (OS/400 specific)
  • libressl
  • mbedTLS
  • NSS
  • OpenSSL
  • rustls
  • Schannel (native Windows)
  • Secure Transport (native macOS)
  • WolfSSL
When you build curl and libcurl to use one of these libraries, it is important that you have the library and its include headers installed on your build machine.

configure

Below, you will learn how to tell configure to use the different libraries. The configure script will not select any TLS library by default. You must select one, or instruct configure that you want to build without TLS support using --without-ssl.

OpenSSL, BoringSSL, libressl

1
./configure --with-openssl
Copied!
configure will detect OpenSSL in its default path by default. You can optionally point configure to a custom install path prefix where it can find OpenSSL:
1
./configure --with-openssl=/home/user/installed/openssl
Copied!
The alternatives BoringSSL and libressl look similar enough that configure will detect them the same way as OpenSSL. It then uses additional measures to figure out which of the particular flavors it is using.

GnuTLS

1
./configure --with-gnutls
Copied!
configure will detect GnuTLS in its default path by default. You can optionally point configure to a custom install path prefix where it can find gnutls:
1
./configure --with-gnutls=/home/user/installed/gnutls
Copied!

NSS

1
./configure --with-nss
Copied!
configure will detect NSS in its default path by default. You can optionally point configure to a custom install path prefix where it can find NSS:
1
./configure --with-nss=/home/user/installed/nss
Copied!

WolfSSL

1
./configure --with-wolfssl
Copied!
configure will detect WolfSSL in its default path by default. You can optionally point configure to a custom install path prefix where it can find WolfSSL:
1
./configure --with-wolfssl=/home/user/installed/wolfssl
Copied!

mbedTLS

1
./configure --with-mbedtls
Copied!
configure will detect mbedTLS in its default path by default. You can optionally point configure to a custom install path prefix where it can find mbedTLS:
1
./configure --with-mbedtls=/home/user/installed/mbedtls
Copied!

Secure Transport

1
./configure --with-secure-transport
Copied!
configure will detect Secure Transport in its default path by default. You can optionally point configure to a custom install path prefix where it can find Secure Transport:
1
./configure --with-secure-transport=/home/user/installed/darwinssl
Copied!

Schannel

1
./configure --with-schannel
Copied!
configure will detect Schannel in its default path by default.
(WinSSL was previously an alternative name for Schannel, and earlier curl versions instead needed --with-winssl)

BearSSL

1
./configure --with-bearssl
Copied!
configure will detect BearSSL in its default path by default. You can optionally point configure to a custom install path prefix where it can find BearSSL:
1
./configure --with-bearssl=/home/user/installed/bearssl
Copied!

Rustls

1
./configure --with-rustls
Copied!
When told to use "rustls", curl is actually trying to find and use the rustls-ffi library - the C API for the rustls library. configure will detect rustls-ffi in its default path by default. You can optionally point configure to a custom install path prefix where it can find rustls-ffi:
1
./configure --with-rustls=/home/user/installed/rustls-ffi
Copied!