The -k / --insecure flag
When curl refuses to connect with an error like SSL certificate problem: self-signed certificate or certificate has expired, -k skips the check:
curl -k https://self-signed.local/api
# long form
curl --insecure https://self-signed.local/apicurl still negotiates an encrypted TLS connection — it just stops verifying that the certificate is trusted and matches the host. That distinction matters: the traffic is encrypted, but you've given up the guarantee that you're talking to the right server.
When it is safe to use -k
Skipping verification is reasonable only when you already trust the connection by other means:
- A local server or staging environment using a self-signed certificate.
- An internal tool with a misconfigured or not-yet-issued cert.
- Quick debugging to confirm the SSL error is the only thing blocking a request.
Never use -k in production
Disabling verification opens you to man-in-the-middle attacks — anyone who can intercept the connection can impersonate the server and you'll never know. Treat -k as a temporary workaround, not a fix.
The safer fix: trust the right certificate
Instead of ignoring all verification, point curl at the specific CA or certificate it should trust with --cacert (or --capath for a directory):
# Trust a specific CA bundle / self-signed cert
curl --cacert /path/to/ca.pem https://internal.example.com
# Provide a client certificate (mutual TLS)
curl --cert client.pem --key client.key https://example.comThis keeps verification on — you still get MITM protection — while accepting the certificate you actually expect. It's the correct long-term solution for internal services with their own CA.
SSL errors when scraping
If you hit SSL errors against a public site that loads fine in a browser, -k usually isn't the answer. The common causes are a missing or outdated CA bundle on your machine, or an anti-bot layer terminating the TLS handshake because it doesn't like your TLS fingerprint. In the second case the certificate is valid; the block is happening at the handshake. A scraping API that presents a real browser's TLS profile resolves it — see the code example. Sites returning 403 or Cloudflare errors after the handshake need the same treatment.