title: cURL not respecting TLS v1
body: <p>I'm having trouble connecting to a TLS-only backend. The configuration is the following:</p>
  
  <ul>
  <li><p><strong>Client</strong>: Android device (Moto X gen 2, Android 5.1) with curl version:</p>
  
  <pre><code>curl 7.21.3 (arm-unknown-eabi) libcurl/7.21.3 OpenSSL/1.0.1j zlib/1.2.8
  Protocols: http https 
  Features: IPv6 NTLM SSL libz
  </code></pre></li>
  <li><p><strong>Server</strong>: Wildcard cert (DigiCert SHA2 Secure Server CA), with <strong>backend accepting TLS 1.0 or higher</strong>-only.</p></li>
  </ul>
  
  <p>When using cURL 7.43.0 in OS X the connection works fine, since the client is respecting the server's highest TLS version:</p>
  
  <pre><code>curl -vvv -X GET -o /dev/null https://domain
  * Rebuilt URL to: https://domain
    % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                   Dload  Upload   Total   Spent    Left  Speed
    0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying ip...
    0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0* Connected to domain (ip) port 443 (#0)
  * TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
  * Server certificate: *.domain
  * Server certificate: DigiCert SHA2 Secure Server CA
  * Server certificate: DigiCert Global Root CA
    0     0    0     0    0     0      0      0 --:--:--  0:00:01 --:--:--     0&gt; GET / HTTP/1.1
  &gt; Host: domain
  &gt; User-Agent: curl/7.43.0
  &gt; Accept: */*
  &gt; 
  &lt; HTTP/1.1 200 OK
  </code></pre>
  
  <p>But no luck in Android. Since no SSLv3 connections will be accepted, the <code>--tlsv1</code> option is passed. Still, the client chooses to use SSLv3, thus failing to conclude the handshake:</p>
  
  <pre><code>curl -vvv --tlsv1 -X GET https://domain                                                                                                                                                             
  * About to connect() to domain port 443 (#0)
  *   Trying ip... connected
  * Connected to domain (ip) port 443 (#0)
  * successfully set certificate verify locations:
  *   CAfile: none
    CApath: /etc/ssl/certs/
  * SSLv3, TLS handshake, Client hello (1):
  * SSLv3, TLS handshake, Server hello (2):
  * SSLv3, TLS handshake, CERT (11):
  * SSLv3, TLS alert, Server hello (2):
  * SSL certificate problem, verify that the CA cert is OK. Details:
  error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
  * Closing connection #0
  </code></pre>
  
  <p>Same results without specifying TLS 1.0: <code>curl -vvv -X GET https://domain</code></p>
  
  <p>Is there any way that I can tell the client to use TLS and not SSLv3?</p>
  
  <p><strong>Edit</strong>: Check the accepted answer, since it's a good way to really check what cURL is doing in your device. The issue itself was being caused because the cert didn't have the full chain attached to it (intermediate + root certs). Here are a couple of online SSL health checkers that can help you further debug the issue:</p>
  
  <p><a href="https://www.ssllabs.com/ssltest/" rel="nofollow">https://www.ssllabs.com/ssltest/</a></p>
  
  <p><a href="https://www.digicert.com/help/" rel="nofollow">https://www.digicert.com/help/</a></p>