Make sure curl is only used when safe to do so, fixes #9381

src/Composer/Util/HttpDownloader.php

@@ -168,7 +168,7 @@ class HttpDownloader
 
         $rfs = $this->rfs;
 
-        if ($this->curl && preg_match('{^https?://}i', $job['request']['url'])) {
+        if ($this->canUseCurl($job)) {
             $resolver = function ($resolve, $reject) use (&$job) {
                 $job['status'] = HttpDownloader::STATUS_QUEUED;
                 $job['resolve'] = $resolve;
@@ -406,4 +406,25 @@ class HttpDownloader
             );
         }
     }
+
+    private function canUseCurl(array $job)
+    {
+        if (!$this->curl) {
+            return false;
+        }
+
+        if (!preg_match('{^https?://}i', $job['request']['url'])) {
+            return false;
+        }
+
+        if (
+            !empty($job['request']['options']['ssl']['local_cert'])
+            || !empty($job['request']['options']['ssl']['local_pk'])
+            || !empty($job['request']['options']['ssl']['allow_self_signed'])
+        ) {
+            return false;
+        }
+
+        return true;
+    }
 }