Intermittent curl error code 35 - SSL Protocol error

Discussion:

Kulcyk, JoAnn

2016-12-06 20:02:15 UTC

I have coded a curl command in a z/OS REXX EXEC to send data from the mainframe to a CentOS 5 server running Zenoss. It works 99% of the time, but occasionally I get an error code 35, SSL Protocol error. I have captured traces of both good and bad executions of the command and I can see where the bad one fails, but I am still not sure why it is failing. Can anyone help? I have scrubbed the trace data of server names, IP addresses, certificate info, âŠ in order to post it. I think I have left enough to be useful. Thanks!

Trace of error:

Curl Return Code: 35

Zenoss POST (curl) stdout:

== Info: IDN support not present, can't parse Unicode domains == Info: About to connect() to SERVER port 443 (#0)
== Info: Trying IPADDR...
== Info: connected
== Info: Connected to SERVER (IPADDR) port 443 (#0) == Info: SSLv3, TLS handshake, Client hello (1):
=> Send SSL data, 339 bytes (0x153)

Data omitted

== Info: SSLv3, TLS handshake, Server hello (2):
<= Recv SSL data, 81 bytes (0x51)

Data omitted

== Info: SSLv3, TLS handshake, CERT (11):
<= Recv SSL data, 2052 bytes (0x804)

Data omitted

== Info: SSLv3, TLS handshake, Server key exchange (12):
<= Recv SSL data, 525 bytes (0x20d)

Data omitted

== Info: SSLv3, TLS handshake, Server finished (14):
<= Recv SSL data, 4 bytes (0x4)
0000: ....
== Info: SSLv3, TLS handshake, Client key exchange (16):
=> Send SSL data, 134 bytes (0x86)

Data omitted

== Info: SSLv3, TLS change cipher, Client hello (1):
=> Send SSL data, 1 bytes (0x1)
0000: .
== Info: SSLv3, TLS handshake, Finished (20):
=> Send SSL data, 16 bytes (0x10)
0000: .....S... ....0.
== Info: Unknown SSL protocol error in connection to SERVER:port == Info: Closing connection #0

Zenoss POST (curl) stderr:

Warning: --trace-ascii overrides an earlier trace/verbose option
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed

0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0curl: (35) Unknown SSL protocol error in connection to SERVER:port

Trace of good curl execution:

reply_stdin.1= == Info: IDN support not present, can't parse Unicode domains
reply_stdin.2= == Info: About to connect() to SERVER port 443 (#0)
reply_stdin.3= == Info: Trying IPADDR ...
reply_stdin.4= == Info: connected
reply_stdin.5= == Info: Connected to SERVER (IPADDR) port 443 (#0)
reply_stdin.6= == Info: SSLv3, TLS handshake, Client hello (1):
reply_stdin.7= => Send SSL data, 342 bytes (0x156)
reply_stdin.8 â 13: data omitted

reply_stdin.14= == Info: SSLv3, TLS handshake, Server hello (2):
reply_stdin.15= <= Recv SSL data, 81 bytes (0x51)
reply_stdin.16 â 17: data omitted

reply_stdin.18= == Info: SSLv3, TLS handshake, CERT (11):
reply_stdin.19= <= Recv SSL data, 2027 bytes (0x7eb)

reply_stdin.20 - 62 = 0000: data omitted
reply_stdin.63= == Info: SSLv3, TLS handshake, Server finished (14):
reply_stdin.64= <= Recv SSL data, 4 bytes (0x4)
reply_stdin.65= 0000: ....
reply_stdin.66= == Info: SSLv3, TLS handshake, Client key exchange (16):
reply_stdin.67= => Send SSL data, 134 bytes (0x86)
reply_stdin.68 â 70 = 0000: data omitted

reply_stdin.71= == Info: SSLv3, TLS change cipher, Client hello (1):
reply_stdin.72= => Send SSL data, 1 bytes (0x1)
reply_stdin.73= 0000: .
reply_stdin.74= == Info: SSLv3, TLS handshake, Finished (20):
reply_stdin.75= => Send SSL data, 16 bytes (0x10)
reply_stdin.76= 0000: .....&C....j9. .
reply_stdin.77= == Info: SSLv3, TLS change cipher, Client hello (1):
reply_stdin.78= <= Recv SSL data, 1 bytes (0x1)
reply_stdin.79= 0000: .
reply_stdin.80= == Info: SSLv3, TLS handshake, Finished (20):
reply_stdin.81= <= Recv SSL data, 16 bytes (0x10)
reply_stdin.82= 0000: ......Z.....v.(1
reply_stdin.83= == Info: SSL connection using DHE-RSA-AES256-SHA
reply_stdin.84 â 89 = == Info: Server certificate: omitted
reply_stdin.90= == Info: SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
reply_stdin.91= == Info: Server auth using Basic with user 'MainframeREST'
reply_stdin.92= => Send header, 220 bytes (0xdc)
reply_stdin.93 â 100 data omitted

reply_stdin.101= => Send data, 475 bytes (0x1db)
reply_stdin.102 â 109 = 0000: data omitted

reply_stdin.110= == Info: upload completely sent off: 475 out of 475 bytes
reply_stdin.111= <= Recv header, 17 bytes (0x11)
reply_stdin.112= 0000: HTTP/1.1 200 OK
reply_stdin.113= <= Recv header, 37 bytes (0x25)
reply_stdin.114= 0000: Date: Thu, 06 Oct 2016 21:41:48 GMT
reply_stdin.115= <= Recv header, 58 bytes (0x3a)
reply_stdin.116= 0000: Server: Zope/(2.13.13, python 2.7.2, linux2) ZServer/1.1
reply_stdin.117= <= Recv header, 21 bytes (0x15)
reply_stdin.118= 0000: Content-Length: 175
reply_stdin.119= <= Recv header, 32 bytes (0x20)
reply_stdin.120= 0000: Content-Type: application/json
reply_stdin.121= <= Recv header, 66 bytes (0x42)
reply_stdin.122= 0000: Set-Cookie: _ZopeId="50762386A7pslc.U4N0"; Path=/zport; HTTPOnly
reply_stdin.123= 0040:
reply_stdin.124= <= Recv header, 19 bytes (0x13)
reply_stdin.125= 0000: Connection: close
reply_stdin.126= <= Recv header, 2 bytes (0x2)
reply_stdin.127= 0000:
reply_stdin.128= <= Recv data, 175 bytes (0xaf)
reply_stdin.129 â 131 = 0000: data omitted
reply_stdin.132= #âÃÃÃÃâÅ¡â¬âÃÃÃâËÃÃÃÃââ¢â¢âÃâ¢â¢/Ãâ
________________________________
ÃâÃâ/â¢ÃÃÃ/ËââÅâ¬â/ÃÃÃ?>âÅ¡â¬âÃ¡ÃÃ>ÃÃÃª?ÃÃÃÃâÅâ¬âÃÃÃÃ%ÃâÅ¡â¬#â_ÃÃâÅ¡â¬âÃ€ÃÃ/ÃÃÃâ¬ÃÃÃ>ÃâÅâ¬â
ÃÃÃÃâÅ¡â¬ÃÃÃÃ'Åâ¬âÃÃÃâÅ¡â¬âÅâ¬âÃ`ÃžÃâÅ¡â¬âÃÃžÃâÅâ¬â_ÃÃÃ?ÃâÅ¡â¬â/ÃÃ^ÃÃÃ>Ãâ'== Info: Closing connection #0
reply_stdin.133= == Info: SSLv3, TLS alert, Client hello (1):
reply_stdin.134= => Send SSL data, 2 bytes (0x2)
reply_stdin.135= 0000: ..
reply_stdin.136=

----------------------------------------------------------------------
The information contained in this communication may be confidential, is intended only for the use of the recipient(s) named above, and may be protected under state or federal law. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication, or any of its contents, is strictly prohibited. If you have received this communication in error, please forward the communication to ***@glhec.org immediately and destroy or delete the original message and any copy of it from your computer system. If you have any questions concerning this message, please contact the sender.

Ray Satiro via curl-users

2016-12-08 07:28:21 UTC

Permalink

Post by Kulcyk, JoAnn
I have coded a curl command in a z/OS REXX EXEC to send data from the
mainframe to a CentOS 5 server running Zenoss. It works 99% of the
time, but occasionally I get an error code 35, SSL Protocol error. I
have captured traces of both good and bad executions of the command
and I can see where the bad one fails, but I am still not sure why it
is failing. Can anyone help? I have scrubbed the trace data of server
names, IP addresses, certificate info, … in order to post it. I think
I have left enough to be useful.

Kulcyk, JoAnn

2017-01-20 20:58:24 UTC

Permalink

Revisiting this problem with new traces. I cannot reproduce it, but I was able to get good and bad traces to the production server. There is only 1 production server. Intermittently I get a curl return code 35 (first trace, below). The second trace is curl return code 0. Can anyone help? Thanks.

Curl Error 35:

== Info: IDN support not present, can't parse Unicode domains == Info: About to connect() to xxzenoss.xxxxx.org port 443 (#0)
== Info: Trying 172.27.66.144...
== Info: connected
== Info: Connected to xxzenoss.xxxxx.org (172.27.66.144) port 443 (#0) == Info: SSLv3, TLS handshake, Client hello (1):
=> Send SSL data, 339 bytes (0x153)

Data omitted

== Info: SSLv3, TLS handshake, Server hello (2):
<= Recv SSL data, 81 bytes (0x51)

Data omitted

== Info: SSLv3, TLS handshake, CERT (11):
<= Recv SSL data, 2052 bytes (0x804)

Data omitted

== Info: SSLv3, TLS handshake, Server key exchange (12):
<= Recv SSL data, 525 bytes (0x20d)

Data omitted

== Info: SSLv3, TLS handshake, Server finished (14):
<= Recv SSL data, 4 bytes (0x4)
0000: ....
== Info: SSLv3, TLS handshake, Client key exchange (16):
=> Send SSL data, 134 bytes (0x86)

Data omitted

== Info: SSLv3, TLS change cipher, Client hello (1):
=> Send SSL data, 1 bytes (0x1)
0000: .
== Info: SSLv3, TLS handshake, Finished (20):
=> Send SSL data, 16 bytes (0x10)
0000: ..........'H....
== Info: Unknown SSL protocol error in connection to xxzenoss.xxxxx.org:443 == Info: Closing connection #0

Curl return code 0 (No Error):

== Info: IDN support not present, can't parse Unicode domains == Info: About to connect() to xxzenoss.xxxxx.org port 443 (#0)
== Info: Trying 172.27.66.144...
== Info: connected
== Info: Connected to xxzenoss.xxxxx.org (172.27.66.144) port 443 (#0) == Info: SSLv3, TLS handshake, Client hello (1):
=> Send SSL data, 339 bytes (0x153)

Data omitted

== Info: SSLv3, TLS handshake, CERT (11):
<= Recv SSL data, 2052 bytes (0x804)

Data omitted

== Info: SSLv3, TLS handshake, Server key exchange (12):
<= Recv SSL data, 525 bytes (0x20d)

Data omitted

== Info: SSLv3, TLS handshake, Server finished (14):
<= Recv SSL data, 4 bytes (0x4)
0000: ....
== Info: SSLv3, TLS handshake, Client key exchange (16):
=> Send SSL data, 134 bytes (0x86)

Data omitted

== Info: SSLv3, TLS change cipher, Client hello (1):
=> Send SSL data, 1 bytes (0x1)
0000: .
== Info: SSLv3, TLS handshake, Finished (20):
=> Send SSL data, 16 bytes (0x10)
0000: ....e..%...=..].
== Info: SSLv3, TLS change cipher, Client hello (1):
<= Recv SSL data, 1 bytes (0x1)
0000: .
== Info: SSLv3, TLS handshake, Finished (20):
<= Recv SSL data, 16 bytes (0x10)
0000: ....../..... ._j
== Info: SSL connection using DHE-RSA-AES256-SHA == Info: Server certificate:

Certificate Data omitted

== Info: SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
== Info: Server auth using Basic with user 'MainframeREST'
=> Send header, 221 bytes (0xdd)
0000: POST /zport/dmd/evconsole_router HTTP/1.1
002b: Authorization: Basic TWFpbmZyYW1lUkVTVDo0T3BUZEsjOSFUajA=
0066: User-Agent: curl/7.28.0
007f: Host: xxzenoss.xxxxx.org
0099: Accept: */*
00a6: Content-Type: application/json
00c6: Content-Length: 512
00db:
=> Send data, 512 bytes (0x200)

Data omitted

== Info: upload completely sent off: 512 out of 512 bytes <= Recv header, 17 bytes (0x11)
0000: HTTP/1.1 200 OK
<= Recv header, 37 bytes (0x25)
0000: Date: Fri, 20 Jan 2017 20:19:04 GMT <= Recv header, 58 bytes (0x3a)
0000: Server: Zope/(2.13.13, python 2.7.2, linux2) ZServer/1.1 <= Recv header, 21 bytes (0x15)
0000: Content-Length: 175
<= Recv header, 32 bytes (0x20)
0000: Content-Type: application/json
<= Recv header, 61 bytes (0x3d)
0000: Set-Cookie: _ZopeId="28140649A7zGIxIv9QA"; Path=/; HTTPOnly <= Recv header, 19 bytes (0x13)
0000: Connection: close
<= Recv header, 2 bytes (0x2)
0000:
<= Recv data, 175 bytes (0xaf)
0000: {"uuid": "484ead5b-a9b8-450c-b092-aa9be8df9fc2", "action": "Even
0040: tsRouter", "result": {"msg": "Created event", "success": true},
0080: "tid": 1, "type": "rpc", "method": "add_event"} #‚ÍÍÑÀ‚š€‚”˜”Á/À•Â/™Â˜”•ÄÂ™//™ÂÁ˜ÀÃ™ÃÄ‚Œ€‚/ÄÈÑ?>‚š€‚áÎÁ>ÈËê?ÍÈÁÊ‚Œ€‚ÊÁËÍ%È‚š€#‚_ËÅ‚š€‚äÊÁ/ÈÁÀ€ÁÎÁ>È‚Œ€‚ËÍÄÄÁËË‚š€ÈÊÍÁ'Œ€‚ÈÑÀ‚š€‘Œ€‚È`øÁ‚š€‚ÊøÄ‚Œ€‚_ÁÈÇ?À‚š€‚/ÀÀ^ÁÎÁ>È‚'== Info: Closing connection #0 == Info: SSLv3, TLS alert, Client hello (1):
=> Send SSL data, 2 bytes (0x2)
0000: ..

-----Original Message-----
From: curl-users [mailto:curl-users-***@cool.haxx.se] On Behalf Of Ray Satiro via curl-users
Sent: Thursday, December 08, 2016 1:28 AM
To: curl-***@cool.haxx.se
Cc: Ray Satiro
Subject: Re: FW: Intermittent curl error code 35 - SSL Protocol error

A --trace for something like this is good but wireshark will help you more if you can reproduce it. Is it possible there is not just a single server but more than one, because those two traces have some differences in handshake order. Possibly one of the servers only accepts certain versions of SSL/TLS that your client does not accept, so no negotiation can be made. Even if you have just a single IP address you are connecting to there may be more than one origin server.
-------------------------------------------------------------------
List admin: https://urldefense.proofpoint.com/v2/url?u=https-3A__cool.haxx.se_list_listinfo_curl-2Dusers&d=DQIDaQ&c=1Bxv1FLhNT7kWd-TXJNAbxBgVXw_rHZTiwmA6CMJ1Y8&r=eGiQa_a7akLWLdMeCGXhoLhnC-Fp_CC1wx2IvaSI-D8&m=nbiNEWyVrpIHw2AgscC2ruo0V8EUTKaXfpWjELyST7c&s=xI8znPj-xBFcdeKc9jVV97y94ImYrSDsLxEtFO_t_6k&e=
FAQ: https://urldefense.proofpoint.com/v2/url?u=https-3A__curl.haxx.se_docs_faq.html&d=DQIDaQ&c=1Bxv1FLhNT7kWd-TXJNAbxBgVXw_rHZTiwmA6CMJ1Y8&r=eGiQa_a7akLWLdMeCGXhoLhnC-Fp_CC1wx2IvaSI-D8&m=nbiNEWyVrpIHw2AgscC2ruo0V8EUTKaXfpWjELyST7c&s=aofySgXDKCmlfpOik7ZAe10rh7P2C4fcreptueoJJ6Y&e=
Etiquette: https://urldefense.proofpoint.com/v2/url?u=https-3A__curl.haxx.se_mail_etiquette.html&d=DQIDaQ&c=1Bxv1FLhNT7kWd-TXJNAbxBgVXw_rHZTiwmA6CMJ1Y8&r=eGiQa_a7akLWLdMeCGXhoLhnC-Fp_CC1wx2IvaSI-D8&m=nbiNEWyVrpIHw2AgscC2ruo0V8EUTKaXfpWjELyST7c&s=HUdbyL-OZI8TI7Y1o581vWrhUph8a9fwpH8HD4iNEQw&e=

----------------------------------------------------------------------
The information contained in this communication may be confidential, is intended only for the use of the recipient(s) named above, and may be protected under state or federal law. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication, or any of its contents, is strictly prohibited. If you have received this communication in error, please forward the communication to ***@glhec.org immediately and destroy or delete the original message and any copy of it from your computer system. If you have any questions concerning this message, please contact the sender.

-----------------------------------------------------------
Unsubscribe: https://cool.haxx.se/list/listinfo/curl-users
Etiquette: htt

Daniel Stenberg

2017-01-20 22:10:49 UTC

Permalink

Post by Kulcyk, JoAnn
Revisiting this problem with new traces. I cannot reproduce it, but I was
able to get good and bad traces to the production server. There is only 1
production server. Intermittently I get a curl return code 35 (first trace,
below). The second trace is curl return code 0. Can anyone help? Thanks.
0066: User-Agent: curl/7.28.0

--
/ daniel.haxx.se
-----------------------------------------------------------
Unsubscribe: https://cool.haxx.se/list/listinfo/curl-users
Etiqu

Kulcyk, JoAnn

2017-01-20 22:16:26 UTC

Permalink

Thanks. I know curl is out of date but I have been told not to update it for whatever reason. You have a good question. I don't know that it's not a server side problem. I was hoping someone who can read the trace would be able to help me identify that. Thanks again.

-----Original Message-----
From: curl-users [mailto:curl-users-***@cool.haxx.se] On Behalf Of Daniel Stenberg
Sent: Friday, January 20, 2017 4:11 PM
To: the curl tool
Subject: RE: FW: Intermittent curl error code 35 - SSL Protocol error

Post by Kulcyk, JoAnn
Revisiting this problem with new traces. I cannot reproduce it, but I
was able to get good and bad traces to the production server. There is
only 1 production server. Intermittently I get a curl return code 35
(first trace, below). The second trace is curl return code 0. Can anyone help? Thanks.
0066: User-Agent: curl/7.28.0

I realize this is an answer you won't like, but I'll say it anyway:

That curl version is 33 releases and over 4 years old. I suppose your TLS library is then similarly as old. I would strongly suggest you upgrade both of those, at least for testing purposes, to see if that makes anything different.
You won't get our full attention until you can show a likely problem with a modern version anyway.

How do you make sure this isn't a server side problem or otherwise outside of curl?
--
/ daniel.haxx.se
-----------------------------------------------------------
Unsubscribe: https://urldefense.proofpoint.com/v2/url?u=https-3A__cool.haxx.se_list_listinfo_curl-2Dusers&d=DgIDaQ&c=1Bxv1FLhNT7kWd-TXJNAbxBgVXw_rHZTiwmA6CMJ1Y8&r=eGiQa_a7akLWLdMeCGXhoLhnC-Fp_CC1wx2IvaSI-D8&m=rr35S-5Amy5eHELSBg3zfOai_o-su9RBsAm5oRgUAVQ&s=R-4DPAkeaoUGM0OP5PXpTVbRhhkYZkgFLFz-sFngH44&e=
Etiquette: https://urldefense.proofpoint.com/v2/url?u=https-3A__curl.haxx.se_mail_etiquette.html&d=DgIDaQ&c=1Bxv1FLhNT7kWd-TXJNAbxBgVXw_rHZTiwmA6CMJ1Y8&r=eGiQa_a7akLWLdMeCGXhoLhnC-Fp_CC1wx2IvaSI-D8&m=rr35S-5Amy5eHELSBg3zfOai_o-su9RBsAm5oRgUAVQ&s=Tu7VEyw-97aXk3BkiriSzlHsWRd-By6p96I8UpB5800&e=

----------------------------------------------------------------------
The information contained in this communication may be confidential, is intended only for the use of the recipient(s) named above, and may be protected under state or federal law. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication, or any of its contents, is strictly prohibited. If you have received this communication in error, please forward the communication to ***@glhec.org immediately and destroy or delete the original message and any copy of it from your computer system. If you have any questions concerning this message, please contact the sender.

-----------------------------------------------------------
Unsubscribe: https://cool.haxx.se/list/listinfo/curl-users
Etiquette: https://curl.haxx.s

Daniel Stenberg

2017-01-20 22:28:20 UTC

Permalink

Post by Kulcyk, JoAnn
I was hoping someone who can read the trace would be able to help me
identify that.

--
/ daniel.haxx.se
-----------------------------------------------------------
Unsubscribe: https://cool.haxx.se/list/listinfo/curl-users
Etiquette: https://curl.haxx.se/mail/e

Kulcyk, JoAnn

2017-01-20 22:30:00 UTC

Permalink

OK - Thanks again.

-----Original Message-----
From: curl-users [mailto:curl-users-***@cool.haxx.se] On Behalf Of Daniel Stenberg
Sent: Friday, January 20, 2017 4:28 PM
To: the curl tool
Subject: RE: FW: Intermittent curl error code 35 - SSL Protocol error

Post by Kulcyk, JoAnn
I was hoping someone who can read the trace would be able to help me
identify that.

I don't think that's possible. All we can see there, is that there's a problem at the TLS/SSL level as far as curl is concerned. That shown error message is however very generic so we can't tell much about what the problem is or who to blame for it.
--
/ daniel.haxx.se
-----------------------------------------------------------
Unsubscribe: https://urldefense.proofpoint.com/v2/url?u=https-3A__cool.haxx.se_list_listinfo_curl-2Dusers&d=DgIDaQ&c=1Bxv1FLhNT7kWd-TXJNAbxBgVXw_rHZTiwmA6CMJ1Y8&r=eGiQa_a7akLWLdMeCGXhoLhnC-Fp_CC1wx2IvaSI-D8&m=Ruc_M18kNLHN3Pyt3qEWWBmrsij8fELFD2ujBgdzTxY&s=EjOhdxBBp0mxSHgoECI7M2J4yP243G1uWs_niDteUTA&e=
Etiquette: https://urldefense.proofpoint.com/v2/url?u=https-3A__curl.haxx.se_mail_etiquette.html&d=DgIDaQ&c=1Bxv1FLhNT7kWd-TXJNAbxBgVXw_rHZTiwmA6CMJ1Y8&r=eGiQa_a7akLWLdMeCGXhoLhnC-Fp_CC1wx2IvaSI-D8&m=Ruc_M18kNLHN3Pyt3qEWWBmrsij8fELFD2ujBgdzTxY&s=6lAo-ngIxV4YOiKrNEBSzPbsUrgofQSti1UjIZfHu1w&e=

----------------------------------------------------------------------
The information contained in this communication may be confidential, is intended only for the use of the recipient(s) named above, and may be protected under state or federal law. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication, or any of its contents, is strictly prohibited. If you have received this communication in error, please forward the communication to ***@glhec.org immediately and destroy or delete the original message and any copy of it from your computer system. If you have any questions concerning this message, please contact the sender.

-----------------------------------------------------------
Unsubscribe: https://cool.haxx.se/list/listinfo/curl-users
Etiquette: https://curl.haxx.se/m

Ray Satiro via curl-users

2017-01-20 22:49:48 UTC

Permalink

Post by Kulcyk, JoAnn
Revisiting this problem with new traces. I cannot reproduce it, but I was able to get good and bad traces to the production server. There is only 1 production server. Intermittently I get a curl return code 35 (first trace, below). The second trace is curl return code 0. Can anyone help? Thanks.

I don't know if you accidentally omitted this from your sanitized log
but the successful transfer contains a server hello and the unsuccessful
one does not. +1 for everything Daniel said, and also please re-read
what I said last year [1] and try Wireshark.

[1]: https://curl.haxx.se/mail/archive-2016-12/0003.html
-----------------------------------------------------------
Unsubscribe: https://cool.haxx.se/list/listinfo/curl-users
Etiquette: https