To bypass cURL SSL/TLS certificate verification, use the -k or --insecure option. You can also add insecure to a .curlrc file or disable SSL certificate verification in code. Doing so will tell cURL to continue with your requests even when it cannot verify the server’s certificate.
However, only ignore SSL certificate errors when you trust the server and understand why verification is failing.
In this article, we'll explain why cURL SSL certificate errors happen, show you how to bypass SSL certificate verification when necessary, and cover safer ways to fix the problem without disabling this security check.
How SSL works in cURL and why it fails
If your console shows an SSL certificate verification error, cURL could not verify the certificate presented by the target server and confirm that the server is who it claims to be. There are a couple of reasons why this SSL error could have happened:
- The server's certificate could be expired.
- The certificate could be self-signed, meaning it was signed by the same organization that created it instead of a third-party authority that cURL trusts.
- The certificate could have been issued for a different domain name than the one cURL is trying to reach.
- The certificate chain could be incomplete, and cURL may be unable to trace the certificate back to a trusted root authority.
- Sometimes the SSL certificate problem is on your side. The copy of cURL you are using may be missing or unable to find the trust information it needs to verify the certificate.
That being said, this error is not random. It means cURL is refusing to connect to a server whose certificate it cannot establish trust in. Once you know why cURL cannot complete the verification, you can decide whether to fix the certificate problem or deliberately bypass the check.
Methods to bypass SSL certificate verification in cURL
There are three primary ways you could bypass SSL certificate verification in cURL. You can use the -k or --insecure option, change the cURL configuration, or disable verification in code.
The method you choose depends on whether you can trust the target and whether you need a one-time workaround or want the setting to apply more broadly.
Using the -k or --insecure option
Here is the basic syntax:
curl -k https://example.com
or
curl --insecure https://example.com
The -k or --insecure option only applies to the current cURL HTTPS request you are running. It does not permanently change your cURL settings, so the next time you run cURL without it, SSL certificate verification will happen as usual. But if you include multiple URLs in the same cURL HTTPS request, -k or --insecure applies to all of them.
Routing requests through a proxy requires some additional setup. See our guide to using a proxy with cURL and see how to configure, authenticate, and troubleshoot proxies with cURL.
Modifying cURL configuration files (.curlrc method)
Instead of using the -k option every time, you can add insecure to a cURL configuration file, and cURL will ignore the verification check automatically on all your commands. Here is how you can do that:
On Linux and macOS, create a file named .curlrc in your home directory. Create it from the terminal like this:
touch ~/.curlrc
Then open it in a text editor and add:
insecure
Save the file.
On Windows, run this command in PowerShell:
notepad "$HOME\.curlrc"
Then add:
insecure
Save the file.
Keep in mind that this setting applies to future cURL commands that use the configuration file, so remove the insecure line once you are done.
Disabling SSL verification in code
If you are making the request from PHP or Python, you can tell the HTTP client not to verify the server certificate. Say, for instance, you have a PHP application using cURL to call a staging server for a website you are building, and that server uses a self-signed certificate or a certificate the local environment does not trust.
You could set:
CURLOPT_SSL_VERIFYPEER => false
so the request continues without verifying the certificate.
Or maybe you are working with Python requests to scrape data from an internal API or development endpoint with a certificate that is invalid for one reason or another.
You could set:
requests.get("https://example.com", verify=False)
and Python will not verify the server certificate for that request.
If you're making API calls directly from the terminal, our guide to cURL API requests covers request methods, authentication, headers, and troubleshooting.
Security risks of ignoring SSL certificate verification
As noted above, the SSL certificate verification that may have failed on your device is how cURL confirms that it is talking to the intended server. Once you disable it, cURL no longer knows who is on the other end of the connection, which increases the risk of a man-in-the-middle (MITM) attack.
This kind of attack works exactly like the name suggests. Without SSL certificate verification, an attacker could position themselves between you and the server you intend to reach. So instead of:
You → real server
you get:
You → attacker → real server
The dangerous part is that both sides can still appear to be communicating as usual. The attacker receives your requests and forwards them to the real server, then receives the response from the server and forwards it back to you. This creates two kinds of problems:
- Interception: The attacker in the middle can read the requests you send. So if you are sending API keys, bearer tokens, login credentials, session cookies, or anything private in that request, the person could see that information.
- Integrity: Because the attacker is in the middle, they can also see the response that comes from the server and modify it before forwarding it. To your system, it may still look like a valid response.
This is why it is important to know when to disable cURL verification and when not to do it. It can be useful when:
- Testing a local or development server
- Working with a known self-signed certificate in a controlled environment
- Troubleshooting a certificate problem on infrastructure you control
It can be a bad idea when:
- Sending passwords, API keys, or session data
- Making production requests
- Connecting to a network you do not control
- Dealing with a server whose certificate problem you do not understand
If you know why SSL verification is failing, and you control the environment, bypassing it temporarily may be reasonable. But if you do not know why the certificate cannot be trusted, it is better to fix the trust problem instead of ignoring the warning.
How to handle SSL issues in cURL securely
So how do you fix the problem?
If the server certificate itself is wrong
You need to renew the certificate if cURL has identified that it is expired. This can only work if you control the server on the other end. Renew it or replace it through your hosting provider, certificate authority, or server setup, then try again.
If the certificate is issued for the wrong hostname or the certificate chain is incomplete, you will need to correct that problem on the server instead.
If cURL doesn't know whom to trust
If cURL doesn't know whom to trust, give it the correct CA certificate. Suppose you have the correct certificate:
company-ca.pem
Instead of doing:
curl -k https://api.internal.example
you could do:
curl --cacert company-ca.pem https://api.internal.example
Practice secure development
Here are a few tips to keep in mind when bypassing SSL certificate verification checks in cURL:
- Avoid using --insecure in production. Only use it in testing environments you control.
- Keep the SSL certificate bypass temporary. If you add insecure to a .curlrc file, remove it once you have confirmed what the SSL problem is or once you're done sending requests to the server.
- Fix trust issues first where possible. If you control the server or know which CA should be trusted, it is better to use --cacert or configure the correct CA store rather than ignoring SSL certificate checks.
- Be especially careful with credentials. Don't send API keys, passwords, cookies, tokens, or other sensitive information while certificate verification is disabled.
- Keep development and production environments separate. A development workaround like insecure should never make its way into a production script or deployment configuration.
- Do not copy untrusted cURL configs or commands blindly. They could tell cURL to send local data or files somewhere you did not intend.
Conclusion
To sum it all up, you can bypass SSL verification in cURL by using the --insecure option. You could also tell cURL to automatically ignore verification in a .curlrc file or do it in Python or PHP by telling the HTTP client not to verify the server certificate.
However, this increases the risk of someone sitting between you and your target and seeing or changing what you exchange through a man-in-the-middle attack. That is why you should only bypass verification for servers you trust. If you control the server, focus on fixing the certificate problem instead of bypassing it.
