APITesterThe command
curl -k https://self-signed.badssl.com/What the flags do
| Flag | What it does |
|---|---|
-k | Skip certificate verification. Long form: --insecure. |
--cacert file | The alternative: trust a specific CA or self-signed certificate. |
--proxy-insecure | The same switch for the connection to an HTTPS proxy. |
What -k turns off
With -k, curl accepts any certificate: self-signed, expired, issued for a different hostname, or signed by nobody recognisable. The connection is still encrypted, but encryption without authentication protects you only from passive eavesdroppers. Anyone able to intercept the connection can present their own certificate, and curl will send them your request, headers and credentials without complaint.
It is reasonable for a throwaway request to a local development server or a device on your desk. It is not reasonable in a script, a CI job, a Dockerfile or documentation that others will copy.
curl https://self-signed.badssl.com/ # curl: (60) SSL certificate problem
curl -k https://self-signed.badssl.com/ # works, unverifiedFix the trust instead
For a self-signed development certificate, hand curl that certificate as the trusted root and verification passes for real. For a company CA, do the same with the CA file. For the wrong hostname on a test machine, --resolve lets you use the proper name. Each of these keeps the check that -k throws away.
# trust exactly this self-signed certificate
curl --cacert dev-cert.pem https://localhost:8443/
# fetch a server's certificate to inspect it
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
| openssl x509 -noout -subject -issuer -datesCommon mistakes
insecurein~/.curlrcdisables verification for every curl command you ever run. If it is there, remove it.-kdoes not fix protocol errors. A handshake failure (exit code 35) is not a certificate problem and-kchanges nothing.- It hides real incidents. A certificate that expired last night and a hijacked connection look identical once verification is off.
Related curl examples
Curl -k Flag Example
-k is short for --insecure.
Curl HTTPS Request Example
An https:// URL is all curl needs to use TLS, and it verifies the server's certificate by default.
Curl Proxy Server Example
-x routes a request through a proxy.
Curl Flags Example
Curl has well over two hundred options.
SSL Checker
Find out why verification fails before deciding to switch it off.
All Curl Examples
49 worked examples, grouped by what you are trying to do.
More under HTTPS and TLS
References
- curl man page: -k — The --insecure option and its warnings.
- curl: SSL certificate verification — How curl finds its CA store and what to do when verification fails.
These links leave api-tester.com, which is independent of the projects they point to.
FAQ
How do I make curl ignore SSL certificate errors?
Add -k (or --insecure). Curl then skips TLS certificate verification and connects even when the certificate is self-signed, expired or issued for a different hostname.
Is it safe to use curl --insecure?
Only against servers you control on a network you trust, such as local development. Elsewhere it exposes the request to interception, because the server identity is not checked.
How do I make curl trust a self-signed certificate without -k?
Pass the certificate with --cacert file.pem. Curl then verifies the connection against it.