92

Is there a way to specify curl to use a specific TLS version? Like 1.1 or 1.2? I can see only sslv3 and tlsv1 options in command help. I took latest src and compiled it with openssl 1.0.1e. Still dont see a direct option in help. Is there any other way to set it?

vpram86
  • 2,868
  • 2
    I don't see any options for setting minor TLS version either. Also see this thread: "That's because, when libcurl is configured to use TLSv1, it will automatically use the highest version number supported by your TLS library, and downgrade to TLS 1.0 if the server doesn't support 1.1 or 1.2. There's no separate option here because, until a serious problem is found in 1.0, there doesn't need to be a separate option." – Karan Jun 12 '13 at 18:07

4 Answers4

127

Curl has options to control the TLS version used. At the date of the last revision to this answer, if you want to specify that TLS 1.2 is used but not 1.1 or 1.3 etc, you need something like

curl --tlsv1.2 --tls-max 1.2 ...

There have been several relevant changes in Curl since the original question was asked.

Version 8.17.0

Answer last checked on 2025-12-09 and still applies for the then current version of curl

Version 7.54.0

Since version 7.54.0 the behaviour has changed, see nelsonda's answer.

Options like --tlsv1.2 now specify a minimum version that is to be used, they no longer specify the exact version to be used.

To specify an exact version to be used you likely have to also specify a value for --tls-max

curl --tlsv1.2 --tls-max 1.2 ...

Version 7.52.0

Version 7.52.0 introduced --tlsv1.3 in addition to the other options listed below.

Version 7.34.0

Since version 7.34.0, Curl has options --tlsv1.0, --tlsv1.1 and --tlsv1.2 for this purpose.

The manpage said

-1, --tlsv1

(SSL) Forces curl to use TLS version 1.x when negotiating with a remote TLS server. You can use options --tlsv1.0, --tlsv1.1, and --tlsv1.2 to control the TLS version more precisely (if the SSL backend in use supports such a level of control).

...

--tlsv1.2

(SSL) Forces curl to use TLS version 1.2 when negotiating with a remote TLS server. (Added in 7.34.0)

RedGrittyBrick
  • 88,823
  • 1
    Useful updates. – user2864740 Sep 23 '20 at 18:35
  • 1
    On RHEL 7.9, the latest curl version is 7.29.0, and according to man curl it already supports the options --tlsv1.0 up to --tlsv1.3. According to yum, the version is 7.29.0-59.el7_9.1, probably RedHat backported support for those options. – pepoluan May 17 '24 at 06:55
  • I specify version,, but curl still prints all versions curl https://example.com -v --tlsv1.3 TLSv1.0 (OUT), TLS header, Certificate Status (22).... it eventually selects 1.3: SSL connection using TLSv1.3 but why does it still lists all the other ones? – Stanislav Nov 20 '24 at 01:31
17

Curl's behavior has changed!

For versions prior to 7.54.0, RedGrittyBrick's answer remains correct. For version of curl after 7.54.0 the options --tlsv1.0, --tlsv1.1 and --tlsv1.2 set the minimum version of TLS that curl will use. To specify the maximum use --tls-max <VERSION>.

From the manpage:

--tls-max <VERSION>

(SSL) VERSION defines maximum supported TLS version. The minimum acceptable version is set by tlsv1.0, tlsv1.1, tlsv1.2 or tlsv1.3.

nelsonda
  • 273
  • 1
    It seems that RedHat backported this to curl version 7.29.0, which is the version that comes along RHEL 7.9. man curl indeed mentions this. – pepoluan May 17 '24 at 06:57
4

Additionally to --tlsvX.Y/--sslvZ, which put a hard limit to what protocols curl would choose, you may use --tls-max x.y to softly control protocol negotiation.

AnrDaemon
  • 209
  • 1
  • 6
1

Take a look at the --cipher option see manpage and OpenSSL docs. You should be able to provide a cipher list that will force certain versions.

BowlesCR
  • 2,743