---
name: "CURLOPT_PROXY_ISSUERCERT_BLOB"
section: "3"
platform: "linux"
package: "curl"
version: "8.23.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux", "macos"]
url: "https://new.carta.tech/CURLOPT_PROXY_ISSUERCERT_BLOB"
---

# CURLOPT\_PROXY\_ISSUERCERT\_BLOB(3)

proxy issuer SSL certificate from memory blob

## NAME

CURLOPT\_PROXY\_ISSUERCERT\_BLOB - proxy issuer SSL certificate from memory blob

## SYNOPSIS

```
#include <curl/curl.h>
CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_ISSUERCERT_BLOB,
                          struct curl_blob *blob);
```

## DESCRIPTION

Pass a pointer to a curl\_blob struct, which contains information (pointer and size) about a memory block with binary data of a CA certificate in PEM format. If the option is set, an additional check against the peer certificate is performed to verify the issuer of the HTTPS proxy is indeed the one associated with the certificate provided by the option. This additional check is useful in multi-level PKI where one needs to enforce that the peer certificate is from a specific branch of the tree.

The provided issuer certificate is used only for an issuer check against the peer certificate; it is not validated or trusted by itself.

This option should be used in combination with the *[CURLOPT\_PROXY\_SSL\_VERIFYPEER(3)](/CURLOPT_PROXY_SSL_VERIFYPEER/3.md)* option. Otherwise, the result of the check is not considered as failure.

A specific error code (CURLE\_SSL\_ISSUER\_ERROR) is defined with the option, which is returned if the setup of the SSL/TLS session has failed due to a mismatch with the issuer of peer certificate (*[CURLOPT\_PROXY\_SSL\_VERIFYPEER(3)](/CURLOPT_PROXY_SSL_VERIFYPEER/3.md)* has to be set too for the check to fail).

If the blob is initialized with the flags member of struct curl\_blob set to CURL\_BLOB\_COPY, the application does not have to keep the buffer around after setting this.

This option is an alternative to *[CURLOPT\_PROXY\_ISSUERCERT(3)](/CURLOPT_PROXY_ISSUERCERT/3.md)* which instead expects a filename as input.

## DEFAULT

NULL

## PROTOCOLS

This functionality affects  all TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc. only

This option works only with the following TLS backends: OpenSSL

## EXAMPLE

```
static char *certificateData; /* point to the data */
static size_t filesize; /* size of the data */
int main(void)
{
  CURL *curl = curl_easy_init();
  if(curl) {
    CURLcode result;
    struct curl_blob blob;
    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
    /* using an HTTPS proxy */
    curl_easy_setopt(curl, CURLOPT_PROXY, "https://proxy.example:443");
    blob.data = certificateData;
    blob.len = filesize;
    blob.flags = CURL_BLOB_COPY;
    curl_easy_setopt(curl, CURLOPT_PROXY_ISSUERCERT_BLOB, &blob);
    result = curl_easy_perform(curl);
    curl_easy_cleanup(curl);
  }
}
```

## AVAILABILITY

Added in curl 7.71.0

## RETURN VALUE

*[curl\_easy\_setopt(3)](/curl_easy_setopt/3.md)* returns a CURLcode indicating success or error.

CURLE\_OK (0) means everything was OK, non-zero means an error occurred, see *[libcurl-errors(3)](/libcurl-errors/3.md)*.

## SEE ALSO

[**CURLOPT\_ISSUERCERT\_BLOB**(3)](/CURLOPT_ISSUERCERT_BLOB/3.md), [**CURLOPT\_PROXY\_SSL\_VERIFYHOST**(3)](/CURLOPT_PROXY_SSL_VERIFYHOST/3.md), [**CURLOPT\_PROXY\_SSL\_VERIFYPEER**(3)](/CURLOPT_PROXY_SSL_VERIFYPEER/3.md), [**CURLOPT\_SSL\_VERIFYHOST**(3)](/CURLOPT_SSL_VERIFYHOST/3.md), [**CURLOPT\_SSL\_VERIFYPEER**(3)](/CURLOPT_SSL_VERIFYPEER/3.md)