curl: (35) SSL connect error

Common causes

• No shared TLS version or cipher suite, often an old curl or OpenSSL against a TLS 1.2 or 1.3 only server, or the reverse.
• A firewall, proxy or TLS-inspecting device reset the connection during the handshake (SSL_ERROR_SYSCALL).
• The server requires SNI or a client certificate, or the port does not speak TLS at all.
• On Windows, Schannel could not check revocation or rejected the server chain.

How to fix it

1. Read the text after "(35)"; it usually names the real cause, such as an alert or SSL_ERROR_SYSCALL.
2. Run curl -v to see how far the handshake got, and test with openssl s_client -connect host:443 -servername host.
3. Update curl and its TLS library, and check which TLS versions the server accepts.
4. Test from outside the corporate network to rule out an intercepting proxy.