How to Configure cURL for Authenticated SMTP Connection with Self-Signed CA Certificate

Configure cURL Authenticated SMTP Connection with Self-Signed CA Certificate

In this article, we will discuss how to configure cURL to establish an authenticated SMTP connection via STARTTLS, allowing the secure transmission of authentication data and server certificate verification. We will also demonstrate how to utilize a self-signed certificate authority (CA) certificate for this purpose.

Table of Contents

• Certificate Generation
• CA Certificate Installation
• Configuration File Editing
• cURL Commands
• Testing

Certificate Generation

For this demonstration, we'll use OpenSSL to generate a self-signed certificate and the corresponding CA certificate.

# Generate a private key for the server
openssl genrsa -out server.key 2048

# Create a certificate signing request (CSR) for the server
openssl req -new -key server.key -out server.csr

# Self-sign the certificate for the server
openssl x509 -req -in server.csr -signkey server.key -out server.crt

Next, generate the CA certificate:

# Generate the CA private key
openssl genrsa -out ca.key 2048

# Create a self-signed CA certificate
openssl req -x509 -new -nodes -key ca.key -out ca.crt

CA Certificate Installation

To allow cURL to validate the self-signed certificate, the CA certificate must be added to the system's trusted CA store. In Linux-based systems, this can typically be accomplished by importing the certificate into the /etc/ssl/certs directory.

# Copy the CA certificate to /usr/local/share/ca-certificates
sudo cp ca.crt /usr/local/share/ca-certificates/

# Update the CA certificate store
sudo update-ca-certificates

Configuration File Editing

In order to use the self-signed CA certificate for verifying the SMTP server's certificate, additional configuration in the cURL directory (/etc/ssl/curl-ca-bundle.crt) is required. Append the CA certificate to the existing curl-ca-bundle.crt file:

# Copy the CA certificate to the cURL directory
sudo cp ca.crt /etc/ssl/curl-ca-bundle.crt

cURL Commands

Now we can use cURL to send an email using an authenticated SMTP connection with the self-signed certificate:

# Send an email using SMTP authentication (replace the required parameters)
curl -v \
--url "smtp://smtp.example.com:587" \
--mail-from "[email protected]" \
--mail-rcpt "[email protected]" \
-u "user:password" \
-T email.txt \
--ssl-reqd \
--cacert /etc/ssl/certs/ca.crt

Explanation

• -v: Enables verbose mode for displaying the progress of the request.
• --url: Specifies the URL of the SMTP server, including the port 587 for STARTTLS.
• --mail-from, --mail-rcpt, -u, -T: Provide sender, recipient, SMTP authentication, and attach the email content in a custom email format.
• --ssl-reqd: Enforces SSL/TLS.
• --cacert: Specifies the path of the CA certificate for certificate verification.

Testing

To validate the SSL/TLS connection between cURL and the SMTP server, users can analyze the verbose output provided during the cURL command execution, ensuring all expected security features are enabled and functioning as intended.

• CURLOPT\_CAINFO
• CURLOPT\_CAPATH
• CURLOPT\_SSLENGINE
• CURLOPT\_SSLENGINE\_DEFAULT
• CURLOPT\_SSL\_VERIFYHOST
• CURLOPT\_SSL\_VERIFYPEER