I'm trying to curl HTTPS website in the following way:

$ curl -v https://thepiratebay.se/

However it fails with the error:

* About to connect() to thepiratebay.se port 443 (#0)
*   Trying
* connected
* Connected to thepiratebay.se ( port 443 (#0)
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS alert, Server hello (2):
* error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
* Closing connection #0
curl: (35) error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

Using -k/--insecure or adding insecure to my ~/.curlrc doesn't make any difference.

How do I ignore or force the certificate using curl command line?

When using wget seems to work fine. Also works when testing with openssl as below:

$ openssl s_client -connect thepiratebay.se:443
SSL handshake has read 2651 bytes and written 456 bytes
New, TLSv1/SSLv3, Cipher is AES128-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
    Protocol  : TLSv1
    Cipher    : AES128-SHA


$ curl --version
curl 7.28.1 (x86_64-apple-darwin10.8.0) libcurl/7.28.1 OpenSSL/0.9.8| zlib/1.2.5 libidn/1.17
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp smtp smtps telnet tftp 
Features: IDN IPv6 Largefile NTLM NTLM_WB SSL libz 

3 Answers 3


Some sites disable support for SSL 3.0 (possible because of many exploits/vulnerabilities), so it's possible to force specific SSL version by either -2/--sslv2 or -3/--sslv3. Also -L is worth a try if requested page has moved to a different location.

In my case it was a curl bug (found in OpenSSL), so curl needed to be upgraded to the latest version (>7.40) and it worked fine.

See also:

  • Yes, upgrading curl fixed the problem for me. Thanks.
    – Simon East
    Feb 1, 2016 at 0:38
  • The latest curl dislikes outdated RC4 cipher that old servers might still use, so I ended up using "--ciphers RC4" to specifically permit it
    – maxpolk
    Feb 11, 2016 at 21:45
  • @SimonEast From which version to which version did you ugprade? Mar 5, 2018 at 15:37

Starting with Mavericks, Apple switched the TLS/SSL engine from OpenSSL to their own Secure Transport engine in Apple distributed cURL binary which breaks client certificate usage. Use the cURL binary from homebrew:

brew install curl
brew link curl --force
  • 2
    brew link curl --force no longer works, you must put export "$(brew --prefix curl)/bin:$PATH" in your .bash_profile instead. Mar 7, 2019 at 13:28

I had this error when I was sending a wrong host header.

I was developing a proxy from to https://site.com:443. so I was sending request headers as-is as came from the browser and there was host: header. I deleted the host header that came from browser to solve the problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.