Styjun

I'm using libcurl in a client application written in C++, to connect to a remote system using HTTPS. The connection is further secured by client certificates. Upon connecting I get the following messages:

Cert file: 'C:my-certsclient.crt'.
Key file: 'C:my-certsclient.key'.
CURL (0): Trying <ipaddress>...
CURL (0): TCP_NODELAY set
CURL (0): Connected to <hostname> (<ipaddress>) port 443 (#0)
CURL (0): schannel: SSL/TLS connection with <hostname> port 443 (step 1/3)
CURL (0): schannel: disabled server certificate revocation checks
CURL (0): schannel: verifyhost setting prevents Schannel from comparing the supplied target name with the subject names in server certificates.
CURL (0): schannel: Failed to get certificate location for C:my-certsclient.crt
The connection to <hostname> was closed.

I'm certain the .crt and .key files exist in the specified location, and are readable. I'm setting the following SSL-related options in CURL:

CURLOPT_SSLCERT: C:my-certsclient.crt
CURLOPT_SSLKEY: C:my-certsclient.key
CURLOPT_SSL_VERIFYHOST: 0
CURLOPT_SSL_VERIFYPEER: 0

What does the message "Failed to get certificate location" mean, and what should I do about it?

I'm using libcurl/7.61.1-DEV WinSSL zlib/1.2.11, taken from vcpkg, and running on Windows 7. The application works fine with client certificates disabled; it's only when I add the SSLCERT and SSLKEY options that it fails.

Seems you can't specify a path to certificate file if libcurl is built with schannel on Windows (native TLS API). You need to specify the path to a cert in System Storage, as stated in docs:

(Schannel only) Client certificates must be specified by a path expression to a certificate store. (Loading PFX is not supported; you can import it to a store first). You can use <store location><store name><thumbprint> to refer to a certificate in the system certificates store, for example, "CurrentUserMY934a7ac6f8a5d579285a74fa61e19f23ddfe8d7a". Thumbprint is usually a SHA-1 hex string which you can see in certificate details. Following store locations are supported: CurrentUser, LocalMachine, CurrentService, Services, CurrentUserGroupPolicy, LocalMachineGroupPolicy, LocalMachineEnterprise.

You can check it inside the libcurl sources as well, look at the functions schannel_connect_step1 and get_cert_location in the file lib/vtls/schannel.c