41

I'm trying to curl HTTPS website in the following way:

$ curl -v https://thepiratebay.se/

However it fails with the error:

* About to connect() to thepiratebay.se port 443 (#0)
*   Trying 173.245.61.146...
* connected
* Connected to thepiratebay.se (173.245.61.146) port 443 (#0)
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS alert, Server hello (2):
* error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
* Closing connection #0
curl: (35) error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

Using -k/--insecure or adding insecure to my ~/.curlrc doesn't make any difference.

How do I ignore or force the certificate using curl command line?

When using wget seems to work fine. Also works when testing with openssl as below:

$ openssl s_client -connect thepiratebay.se:443
CONNECTED(00000003)
SSL handshake has read 2651 bytes and written 456 bytes
New, TLSv1/SSLv3, Cipher is AES128-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : AES128-SHA

I've:

$ curl --version
curl 7.28.1 (x86_64-apple-darwin10.8.0) libcurl/7.28.1 OpenSSL/0.9.8| zlib/1.2.5 libidn/1.17
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp smtp smtps telnet tftp 
Features: IDN IPv6 Largefile NTLM NTLM_WB SSL libz
Improve this question

3 Answers 3

Reset to default
28

Some sites disable support for SSL 3.0 (possible because of many exploits/vulnerabilities), so it's possible to force specific SSL version by either -2/--sslv2 or -3/--sslv3. Also -L is worth a try if requested page has moved to a different location.

In my case it was a curl bug (found in OpenSSL), so curl needed to be upgraded to the latest version (>7.40) and it worked fine.

See also:

Improve this answer
4
  • Yes, upgrading curl fixed the problem for me. Thanks.
    – Simon East
    Feb 1, 2016 at 0:38
  • The latest curl dislikes outdated RC4 cipher that old servers might still use, so I ended up using "--ciphers RC4" to specifically permit it
    – maxpolk
    Feb 11, 2016 at 21:45
  • @SimonEast From which version to which version did you ugprade?
    – Olle Härstedt
    Mar 5, 2018 at 15:37
  • Using curl 7.81.0 on Ubuntu 22.04.1 LTS, trying to get a file from downloads.leginfo.legislature.ca.gov and it does not work. :--(
    – Ray Kiddy
    Jan 25 at 19:36
6

Starting with Mavericks, Apple switched the TLS/SSL engine from OpenSSL to their own Secure Transport engine in Apple distributed cURL binary which breaks client certificate usage. Use the cURL binary from homebrew:

brew install curl
brew link curl --force
Improve this answer
1
  • 2
    brew link curl --force no longer works, you must put export "$(brew --prefix curl)/bin:$PATH" in your .bash_profile instead.
    – Lars Nyström
    Mar 7, 2019 at 13:28
0

I had this error when I was sending a wrong host header.

I was developing a proxy from http://127.0.0.1:12345 to https://site.com:443. so I was sending request headers as-is as came from the browser and there was host:127.0.0.1:12345 header. I deleted the host header that came from browser to solve the problem.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.