Technology · PRACTICAL GUIDE
curl error 35: mark the last successful TLS boundary before changing ciphers
Error 35 says the SSL/TLS handshake failed, not why. Capture the curl build, proxy path and verbose sequence; then change one boundary and repeat.
curl error 35 is a family of handshake failures, not one diagnosis. The important clue is the last boundary that completed: TCP, proxy CONNECT, ClientHello, ServerHello or certificate verification. Preserve that sequence before changing security settings.
Freeze the exact failing path
Record the exact URL without secrets, runner or host, proxy environment, IP family and curl -V. The version output identifies the curl build and TLS backend; backend names matter because OpenSSL, Schannel, GnuTLS, Secure Transport and NSS do not emit identical wording.
Capture the last proven boundary
Run curl -v for a safe request and retain the ordered transport lines after redacting credentials. A TCP connection proves only route and listener. An HTTP proxy 200 to CONNECT proves the tunnel, not the origin TLS handshake. A sent ClientHello proves the TLS attempt; a received alert or ServerHello moves the boundary farther.
Classify the first missing handshake step
HTTP-looking bytes or wrong-version-number before a ServerHello often indicate a non-TLS service, wrong port or proxy-scheme mismatch. A reset after ClientHello points to server, inspection device, SNI, protocol or policy. A certificate message followed by verification failure is a trust or identity branch, not the same branch as an absent ServerHello.
Reproduce independently with s_client
Use openssl s_client with the same host, port and SNI; add its proxy option only when the curl path really uses an HTTP CONNECT proxy. The command can expose protocol, alert, certificate and verification boundaries. It is a comparison probe, not proof that every curl backend has the same policy.
Change one boundary, not five
Retest one controlled variant: the documented port, direct versus the configured proxy when policy allows, the same hostname with an approved resolved address, or one protocol range. Do not combine insecure mode, cipher changes, a proxy bypass and a package upgrade. If the last successful boundary does not move, restore the change.
Prove the repair without weakening trust
Repeat the original failing command and preserve the same boundary ledger plus the one change. Keep certificate and hostname verification enabled. Redact credentials only after retaining sequence and timestamps; curl warns that verbose and trace output can contain sensitive data.
