Curl -k Flag Example

The command

curl -k https://expired.badssl.com/

The flag and its relatives

The two checks it removes

Verification has two parts: the certificate must chain to an authority curl trusts, and it must be issued for the hostname in the URL. -k skips both and nothing else. A TLS handshake still takes place, the minimum protocol version still applies, a pinned key is still compared, and a server that demands a client certificate still gets to demand it.

Each of these four hosts fails for a different reason, and -k silences all of them identically. That sameness is the problem: once the flag is on, curl no longer distinguishes a harmless test certificate from an impostor.

curl -k https://expired.badssl.com/          # past its expiry date
curl -k https://wrong.host.badssl.com/       # issued for another name
curl -k https://self-signed.badssl.com/      # signed by nobody curl trusts
curl -k https://untrusted-root.badssl.com/   # chains to an unknown authority

Scope: which connections are affected

The flag applies to the origin-server connection of the URLs it is grouped with. In a command that uses --next to separate requests, options are reset at each --next, so a -k placed before it does not carry over. An HTTPS proxy and a DNS-over-HTTPS resolver are separate TLS connections with switches of their own. Nothing persists between commands unless you have written insecure into a config file.

# only the first URL is unverified; --next resets the options
curl -k https://localhost:8443/health --next https://api.example.com/health

# an HTTPS proxy needs its own switch
curl -k --proxy-insecure -x https://proxy.example.com:8443 https://localhost:8443/

Seeing what -k let through

Curl still runs the verification and records the outcome; it only stops acting on it. The %{ssl_verify_result} write-out variable prints that outcome: 0 means the certificate would have passed and the flag was unnecessary, and any other number is the TLS library's error code, for example 18 for a self-signed certificate on OpenSSL builds. Verbose output states the same thing in words, on a line ending "continuing anyway".

curl -k -s -o /dev/null -w "verify result: %{ssl_verify_result}\n" https://self-signed.badssl.com/
curl -k -v -o /dev/null https://self-signed.badssl.com/ 2>&1 | grep -i "verify result"

Common mistakes

• Lower-case -k, not capital -K. The capital reads a config file, so curl tries to open your URL as a file and then reports that no URL was given.
• Exit code 60 becomes exit code 0. A script that adds -k loses the only signal it had that a certificate was wrong.
• It is not a fix for exit code 35. A failed handshake is about protocol versions or ciphers, which the flag does not touch.

Related curl examples

References

• curl man page: -k — The --insecure option and its warnings.
• curl: SSL certificate verification — How curl finds its CA store and what to do when verification fails.

These links leave api-tester.com, which is independent of the projects they point to.

FAQ