Curl Ignore Certificate: How to Skip SSL Checks

Yes, you can tell cURL to ignore certificate errors with the -k or --insecure flag. This disables SSL/TLS certificate verification, allowing the transfer to proceed even if the certificate is self-signed, expired, or mismatched. The exact command is curl -k https://example.com, and it works on all major operating systems.

Why cURL Verifies Certificates by Default

When you connect to an HTTPS URL, cURL (and its underlying library, libcurl) performs a series of checks on the server’s certificate:

• It confirms the certificate is signed by a trusted Certificate Authority (CA) in your system’s trust store.
• It verifies the certificate has not expired.
• It checks that the certificate’s hostname matches the domain you are connecting to.
• It ensures the certificate has not been revoked (if revocation info is available).

These checks protect against man-in-the-middle attacks and data interception. When a certificate fails any of these checks, cURL aborts with an error like SSL certificate problem: self-signed certificate or SSL: certificate subject name mismatch.

How to Ignore Certificate Errors

The primary way to bypass certificate verification is the -k (or --insecure) option:

curl -k https://self-signed.example.com

This tells cURL to skip all certificate validation. It works for HTTPS, FTPS, and other TLS-based protocols. You can also use it with -v (verbose) to see that the connection is established despite the certificate warning.

For cases where you only want to ignore a specific problem (like an expired certificate) but still verify the hostname, you can use the --ssl-no-revoke flag on Windows to skip certificate revocation checks, or --resolve to map a hostname to a specific IP while keeping verification. However, these are less common than the blanket -k.

Security Risks of Using -k

Ignoring certificate errors removes the encryption’s integrity guarantee. An attacker could intercept your connection, present a fake certificate, and read or modify the data you send. This is especially dangerous when transmitting passwords, API keys, personal information, or financial data.

The risk is not just theoretical. Public Wi-Fi networks, corporate proxies, and malicious routers can all perform man-in-the-middle attacks. Using -k makes your data visible to these intermediaries.

Even for seemingly harmless requests, you may be leaking information (like authentication tokens in headers) that you did not intend to expose.

When It Is Acceptable to Use -k

There are legitimate scenarios where skipping verification is reasonable:

• Testing a local development server with a self-signed certificate (e.g., https://localhost:3000).
• Connecting to an internal service that uses a private CA you trust but is not in the system store.
• Debugging a connection issue where you want to isolate whether the problem is certificate-related.
• Accessing a device (like a router or IoT gadget) that has a hardcoded self-signed certificate.

In these cases, the data is usually not sensitive, and the risk is limited to the specific network. Still, you should prefer a safer alternative whenever possible.

Better Alternatives to Ignoring Certificates

Instead of disabling verification entirely, you can address the root cause:

1. Add the certificate to your trust store – Download the server’s certificate (or its CA) and add it to your system’s trusted certificates. On Linux, this is often /etc/ssl/certs; on macOS, the Keychain; on Windows, the Certificate Manager. Then cURL will accept it without -k.
2. Use the --cacert option – Point cURL to a specific CA bundle file that contains the certificate you trust: curl --cacert /path/to/ca.pem https://example.com.
3. Use the --cert option for client certificates – If the server requires a client certificate, provide it with --cert and --key instead of disabling verification.
4. Fix the certificate – If you control the server, replace the self-signed certificate with one from a free CA like Let’s Encrypt, or at least ensure the hostname matches.

Common Problems and Troubleshooting

Even with -k, you might encounter issues:

• Certificate still fails – Some servers have incomplete certificate chains. Use --cacert with the full chain, or download the missing intermediate CA.
• Proxy errors – If you are behind a proxy that uses a self-signed certificate, you need to set the HTTPS_PROXY environment variable and possibly use --proxy-insecure to ignore the proxy’s certificate, not the destination’s.
• Protocol not supported – -k only works with TLS-based protocols. If you get error:14090086, it usually means the server is not speaking TLS at all.
• Windows-specific revocation checks – On Windows, cURL may still perform revocation checks. Use --ssl-no-revoke to disable those if they cause failures.

How to Check if the Flag Is Working

Use the verbose flag to see the TLS handshake details:

curl -vk https://example.com

In the output, you will see lines like Server certificate and subject: CN=example.com. Without -k, you would see an error and the connection would abort. With -k, the connection proceeds, and you can see the response headers and body.

Frequently Asked Questions

Does -k work with all cURL versions?

Yes, the -k and --insecure flags have been part of cURL for decades and are supported in every modern version, including the one bundled with Windows 10/11 and macOS.

Can I ignore certificate errors in Python requests?

Yes, in Python’s requests library, you can pass verify=False to the request method. However, this will generate a warning. A better approach is to pass a custom CA bundle via verify='/path/to/ca.pem'.

Is there a way to ignore only the hostname mismatch?

cURL does not have a built-in flag to ignore just the hostname. You can use --resolve to manually map a hostname to an IP, but the certificate must still match the hostname you connect to. Alternatively, use --connect-to to change the connection endpoint while keeping the original hostname for verification.

What does the error ‘unable to get local issuer certificate’ mean?

This error means cURL cannot find the root CA that signed the server’s certificate. It often happens when using a corporate proxy or a private CA. The solution is to use --cacert with the appropriate CA file, or add the CA to your system’s trust store.

Does -k affect performance?

Negligibly. The certificate verification process is fast, and skipping it saves only a few milliseconds. The larger impact is on security, not speed.

Can I use -k with wget?

Yes, wget has an equivalent flag: --no-check-certificate. It works similarly to cURL’s -k and should be used with the same caution.

Related

• Mac Start Up Automatically After Power Failure?
• Expose Self-Hosted Service Securely Without Cloudflare Tunnel
• Nano Delivery for Functional Foods: What It Can and Can’t Do