Why does curl -k -I https://host.example.com not return response headers if certificate is not valid?

Question

Does anyone know why curl with -k (--insecure) option and -I for show headers still shows the html response and not the headers as expected?

Working as expected:

$ curl -I https://validsslcert.example.com
HTTP/1.1 302 Moved Temporarily
Server: Apache-Coyote/1.1
...

$ curl -k -I https://validsslcert.example.com
HTTP/1.1 302 Moved Temporarily
Server: Apache-Coyote/1.1
...

$ curl -k https://invalidcert.example.com
<br />
...

NOT working as expected:

$ curl -k -I https://invalidcert.example.com
<br />
<br />
<br />
<center><h2>Maintenance</h2></center>

It doesn't really matter here what I'm doing, but I'm testing what headers get set to identify different backend acl logic on haproxy.

I would expect curl to allow me to make an insecure connection (invalid certificate) and still return the headers?

Answer 1

Works for me without any problems. Fails without -k:

$ curl -I https://self-signed.badssl.com/
curl: (60) SSL certificate problem: self signed certificate

But succeeds with -k and also shows headers due to -I:

$ curl -k -I https://self-signed.badssl.com/
HTTP/1.1 200 OK
Server: nginx/1.10.3 (Ubuntu)
Date: Mon, 11 Jan 2021 15:16:31 GMT
Content-Type: text/html
Content-Length: 502
Last-Modified: Tue, 24 Mar 2020 00:15:54 GMT
Connection: keep-alive
ETag: "5e79513a-1f6"
Cache-Control: no-store
Accept-Ranges: bytes

Maybe the server in question is simply broken and does not send any HTTP headers (i.e. HTTP/0.9 style response)?