← Knowledge base

curl

curl supports multiple TLS backends. Available command-line options and named groups depend on the installed build and backend.

Evidence to collect

1. Run curl --version to identify the TLS backend.
2. Consult --curves support for that backend; listing a group is an offer, not evidence that a server selected it.
3. Use the canonical local check for validated TLS negotiation. Keep certificate and hostname verification enabled.

Read-only inventory

Run this in the environment used by the application. Missing commands mean the tool is unavailable. This output is inventory, not a negotiation result.

curl --version

Record the scope and result

Record the tested component, client, peer, protocol, selected algorithm, and date. Keep observed negotiation, documented capability, and unknown distinct. A failed check can reflect local tooling, certificate validation, network policy, or configuration; it does not prove that all PQC is unsupported.

Official references

• curl options and TLS backend limitations

Guidance reviewed 24 September 2026. Verify documentation for your deployed release; vendor capabilities and defaults change.