4

When curl to an HTTPS URL and not not defined the SSL version option, which level of SSL/TLS will be used?

From the cURL documentation it says CURL_SSLVERSION_DEFAULT will use as default.

CURL_SSLVERSION_DEFAULT

The default action. This will attempt to figure out the remote SSL protocol version.

So does it depend on the other end of the connection?

Community
  • 1
Gihan
  • 141
  • 1
  • 1
  • 4
  • It varies on which version of curl you're running, on which operating system (and therefore which openssl library is installed). – gowenfawr Sep 09 '15 at 15:08

1 Answers1

4

The SSL protocol involves a handshake where the version is negotiated. The web server and the client will agree on the newest version that they both support. As cURL supports TLS 1.2, the newest standardized version, the version of TLS chosen will correspond to the highest version that the server supports unless you restrict cURL's SSL options.

Googling SSL handshake will give you many references on the version negotiation.

Neil Smithline
  • 14,621
  • 4
  • 38
  • 55