When TLS Fails

TLS failures all look the same from the outside, and they are not the same at all.

Expired certificate. Common, boring, and fixed by renewing it. Name mismatch. You asked for one host and the certificate is for another. Unknown authority. Often an internal service using its own certificate that your machine has no reason to trust. No TLS at all, which you have already seen as exit code 35.

Then there is -k, which tells curl to skip these checks entirely and connect anyway. It makes the error go away, and it throws away the identity guarantee while keeping the encryption. You get a private conversation with someone you have not identified.

That is fine while poking at a test box you control. Using it to silence a warning in anything that matters removes the very protection you were relying on. Fix the certificate instead.