/flags /curl/curl-k-insecure

curl -k (--insecure): skip TLS certificate verification

updated 2026-10-20

tool: curl
command: curl
flag: -k, --insecure
default: off (certificates are verified)

curl -k (long form --insecure) disables verification of the server's TLS certificate, so curl connects even when the certificate is self-signed, expired or issued for another host name. The traffic is still encrypted, but you no longer know who is on the other end. Use it for local testing only.

Without and with -k

Against a host that serves a self-signed certificate:

bash

curl -sS -o /dev/null https://self-signed.badssl.com/

Output · exit 60

curl: (60) schannel: SEC_E_UNTRUSTED_ROOT (0x80090325) - The certificate chain was issued by an authority that is not trusted.
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the webpage mentioned above.

The text after curl: (60) depends on the TLS library curl was built with. OpenSSL builds, common on Linux, describe the certificate problem in their own words; the Windows build (Schannel) used here reports the Windows error code.

bash

curl -sSk -o /dev/null -w '%{http_code}\n' https://self-signed.badssl.com/

Output

Safer alternatives

Situation	Use instead of -k
Internal service signed by your own CA	--cacert /path/to/ca.pem
Corporate proxy that re-signs TLS	add the proxy CA to the system store, or --cacert
Pin one known server	--pinnedpubkey sha256//<base64-hash>
Certificate for another name (testing)	--resolve host:443:IP and the right host name

Sources

config · ssh~/.ssh/config: Host, HostName, User, Port and IdentityFile~/.ssh/config defines per-host SSH settings: an alias with Host, the real name with HostName, plus User, Port and IdentityFile. Check the result with ssh -G.cheat sheets · awkawk cheat sheet: fields, patterns, sums and printfawk cheat sheet: print fields, change the separator, filter rows by pattern or condition, sum and count columns, use BEGIN and END, printf formats and arrays.errors · sshPermission denied (publickey) with sshssh fails with Permission denied (publickey) when the server accepts only keys and none you offer is authorized. Check the key, the user and file permissions.

Without and with -k

Safer alternatives

Sources

Related pages