---
name: "CURLOPT_ISSUERCERT_BLOB"
section: "3"
platform: "linux"
package: "curl"
version: "8.23.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux", "macos"]
url: "https://new.carta.tech/CURLOPT_ISSUERCERT_BLOB"
---

# CURLOPT\_ISSUERCERT\_BLOB(3)

issuer SSL certificate from memory blob

## NAME

CURLOPT\_ISSUERCERT\_BLOB - issuer SSL certificate from memory blob

## SYNOPSIS

```
#include <curl/curl.h>
CURLcode curl_easy_setopt(CURL *handle, CURLOPT_ISSUERCERT_BLOB,
                          struct curl_blob *stblob);
```

## DESCRIPTION

Pass a pointer to a curl\_blob structure, which contains information (pointer and size) about a memory block with binary data of a CA certificate in PEM format. If the option is set, an additional check against the peer certificate is performed to verify the issuer is indeed the one associated with the certificate provided by the option. This additional check is useful in multi-level PKI where one needs to enforce that the peer certificate is from a specific branch of the tree.

The provided issuer certificate is used only for an issuer check against the peer certificate; it is not validated or trusted by itself.

This option should be used in combination with the *[CURLOPT\_SSL\_VERIFYPEER(3)](/CURLOPT_SSL_VERIFYPEER/3.md)* option. Otherwise, the result of the check is not considered as failure.

A specific error code (CURLE\_SSL\_ISSUER\_ERROR) is defined with the option, which is returned if the setup of the SSL/TLS session has failed due to a mismatch with the issuer of peer certificate (*[CURLOPT\_SSL\_VERIFYPEER(3)](/CURLOPT_SSL_VERIFYPEER/3.md)* has to be set too for the check to fail).

If the blob is initialized with the flags member of struct curl\_blob set to CURL\_BLOB\_COPY, the application does not have to keep the buffer around after setting this.

This option is an alternative to *[CURLOPT\_ISSUERCERT(3)](/CURLOPT_ISSUERCERT/3.md)* which instead expects a filename as input.

## DEFAULT

NULL

## PROTOCOLS

This functionality affects  all TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc. only

This option works only with the following TLS backends: OpenSSL

## EXAMPLE

```
extern char *certificateData;
extern size_t filesize;
int main(void)
{
  CURL *curl = curl_easy_init();
  if(curl) {
    CURLcode result;
    struct curl_blob blob;
    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
    blob.data = certificateData;
    blob.len = filesize;
    blob.flags = CURL_BLOB_COPY;
    curl_easy_setopt(curl, CURLOPT_ISSUERCERT_BLOB, &blob);
    result = curl_easy_perform(curl);
    curl_easy_cleanup(curl);
  }
}
```

## AVAILABILITY

Added in curl 7.71.0

## RETURN VALUE

*[curl\_easy\_setopt(3)](/curl_easy_setopt/3.md)* returns a CURLcode indicating success or error.

CURLE\_OK (0) means everything was OK, non-zero means an error occurred, see *[libcurl-errors(3)](/libcurl-errors/3.md)*.

## SEE ALSO

[**CURLOPT\_CRLFILE**(3)](/CURLOPT_CRLFILE/3.md), [**CURLOPT\_ISSUERCERT**(3)](/CURLOPT_ISSUERCERT/3.md), [**CURLOPT\_SSL\_VERIFYHOST**(3)](/CURLOPT_SSL_VERIFYHOST/3.md), [**CURLOPT\_SSL\_VERIFYPEER**(3)](/CURLOPT_SSL_VERIFYPEER/3.md)