Browser-based diagnostic tool

Why Is cURL Failing This HTTPS Request?

Why is cURL failing this HTTPS request? Paste the error and safe verbose lines below to identify the last successful network stage and the most useful next test.

0 characters, 0 lines

Analysis runs entirely in this browser. Your pasted output is not uploaded or stored. Remove secrets before sharing the result anywhere else.

How the cURL HTTPS analyzer works

cURL moves through hostname resolution, TCP connection, optional proxy tunneling, TLS negotiation, HTTP request, and response transfer. The error number narrows the stage, while verbose output shows the last operation that completed. This tool combines those signals instead of treating every HTTPS failure as a certificate problem.

Capture verbose output safely

curl -V
curl -v --connect-timeout 10 --max-time 30 https://host.example/
openssl s_client -connect host.example:443 -servername host.example

Remove authorization headers, cookies, bearer tokens, query-string secrets, client certificates, and internal names before sharing output. The tool itself runs locally, but copied results can still expose sensitive data elsewhere.

Read the last successful stage

  • If the host was not resolved, investigate DNS or proxy name resolution.
  • If cURL never reports a connection, investigate routing, firewall, address family, and the destination port.
  • If the connection succeeds but TLS fails, inspect ClientHello, proxy, certificate, protocol, and reset messages.
  • If HTTP headers appear before the failure, the problem moved beyond the TLS handshake.

Why --insecure is not a fix

--insecure disables certificate identity verification. It can be a tightly controlled diagnostic comparison, but leaving it in scripts or production configuration makes interception harder to detect. Correct the hostname, served chain, trust store, clock, or proxy trust instead.

Compare independent clients carefully

A browser working does not prove that cURL should work. Browsers and cURL may use different proxy settings, DNS paths, trust stores, TLS backends, client certificates, and protocol preferences. Record curl -V and test from the same runtime context as the failing automation.