[CurlOne] PEM Certificate Auto-Injection Strategy for Portable LibreSSL Builds

Architecture Overview

The implementation eliminates target host system trust store
dependencies (such as Windows CryptoAPI/Schannel or system
/etc/ssl/certs directories) by pairing a static php-sm-curl.pem root
bundle alongside the compiled extension binary (.dll or .so). The
module dynamic path discovery phase resolves the location during
initialization and configures handle default options via
CURLOPT_CAINFO.

The core purpose of this feature is to deliver zero-configuration,
standalone HTTPS capabilities for portable CLI runtime environments.

Primary Objectives

⑴ Eliminate System Trust Store Dependencies: Standard LibreSSL builds
on Windows and minimalist BSD/Linux environments lack unified access
to OS root certificate stores. Co-locating the PEM file ensures peer
verification works out of the box without requiring native CryptoAPI
hooks or system /etc/ssl/certs configurations.

⑵ Remove Runtime Directive Overhead: Eliminates the requirement for
end users or deployment scripts to manually configure curl.cainfo
paths within php.ini across varying host environments.

⑶ Enforce Execution Determinism: Guarantees consistent TLS handshake
validation behavior across all host machines by shipping an explicit,
known set of Root Certificate Authorities alongside the extension
binary itself.

⑷ Simplify Application Packaging: Facilitates self-contained CLI tool
distribution where binary folders can be copied to target systems and
run immediately without installation procedures or host system
modifications.
-- 
curl-and-php mailing list
[email protected]
https://lists.haxx.se/mailman/listinfo/curl-and-php