From: Viktor Szakats <commit@vsz.me>
Date: Fri, 22 Aug 2025 15:54:23 +0000 (+0200)
Subject: cmake: `CURL_CA_FALLBACK` only works with OpenSSL
X-Git-Tag: curl-8_16_0~107
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d6c51a8fdaabb33f7dca9546ae8c9c1c5647288e;p=thirdparty%2Fcurl.git

cmake: `CURL_CA_FALLBACK` only works with OpenSSL

Ref: 2f6524ce3c3a8231c62d1e0c8af509fe5b0228a0 #18364
Ref: #18362

Closes #18365
---

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 5e0bf4bf98..a1bc875285 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1501,12 +1501,16 @@ if(_curl_ca_bundle_supported)
   set(CURL_CA_BUNDLE "auto" CACHE
     STRING "Path to the CA bundle. Set 'none' to disable or 'auto' for auto-detection. Defaults to 'auto'.")
   set(CURL_CA_FALLBACK OFF CACHE
-    BOOL "Use built-in CA store of TLS backend. Defaults to OFF")
+    BOOL "Use built-in CA store of OpenSSL. Defaults to OFF")
   set(CURL_CA_PATH "auto" CACHE
     STRING "Location of default CA path. Set 'none' to disable or 'auto' for auto-detection. Defaults to 'auto'.")
   set(CURL_CA_EMBED "" CACHE
     STRING "Path to the CA bundle to embed in the curl tool.")
 
+  if(CURL_CA_FALLBACK AND NOT CURL_USE_OPENSSL)
+    message(FATAL_ERROR "CURL_CA_FALLBACK only works with OpenSSL.")
+  endif()
+
   if(CURL_CA_BUNDLE STREQUAL "")
     message(FATAL_ERROR "Invalid value of CURL_CA_BUNDLE. Use 'none', 'auto' or file path.")
   elseif(CURL_CA_BUNDLE STREQUAL "none")
diff --git a/docs/INSTALL-CMAKE.md b/docs/INSTALL-CMAKE.md
index cad83d909e..956bd104f0 100644
--- a/docs/INSTALL-CMAKE.md
+++ b/docs/INSTALL-CMAKE.md
@@ -258,7 +258,7 @@ target_link_libraries(my_target PRIVATE CURL::libcurl)
 
 - `CURL_CA_BUNDLE`:                         Path to the CA bundle. Set `none` to disable or `auto` for auto-detection. Default: `auto`
 - `CURL_CA_EMBED`:                          Path to the CA bundle to embed in the curl tool. Default: (disabled)
-- `CURL_CA_FALLBACK`:                       Use built-in CA store of TLS backend. Default: `OFF`
+- `CURL_CA_FALLBACK`:                       Use built-in CA store of OpenSSL. Default: `OFF`
 - `CURL_CA_PATH`:                           Location of default CA path. Set `none` to disable or `auto` for auto-detection. Default: `auto`
 - `CURL_CA_SEARCH_SAFE`:                    Enable safe CA bundle search (within the curl tool directory) on Windows. Default: `OFF`