Troubleshooting curl not working on an RHEL8 Server

cURL fails on RHEL8 primarily due to missing packages, firewall restrictions, or SSL/TLS configuration errors. Verify installation with rpm -q curl, ensure firewalld allows outbound traffic without disabling it permanently, and check certificate trust stores for handshake failures. This guide provides diagnostic steps to restore connectivity safely.

Verifying Installation and Dependencies

The first step in troubleshooting is confirming that the curl binary actually exists on the system. In minimal RHEL8 installations, certain tools might not be included by default. Use the package manager to verify the presence of the software.

rpm -q curl
dnf list installed | grep curl

If the package is missing, install it using dnf install curl. Additionally, ensure that the CA certificates package is present. Without valid certificates, curl cannot verify HTTPS connections, leading to silent failures or explicit SSL errors.

rpm -q ca-certificates

If this package is absent, install it via dnf install ca-certificates. This ensures that your system trusts public certificate authorities required for secure web communication.

Diagnosing Network and Firewall Issues

Firewalls are a common culprit when curl hangs or times out. RHEL8 uses firewalld by default. Instead of disabling the firewall entirely, which exposes the server to security risks, configure it to allow necessary outbound traffic. Check the current status of the firewall:

systemctl status firewalld

If the firewall is active, ensure that standard HTTP and HTTPS ports are permitted. While outbound traffic is often allowed by default, restrictive policies may block it. To add rules temporarily for testing:

firewall-cmd --add-port=80/tcp --zone=public --temporary
firewall-cmd --add-port=443/tcp --zone=public --temporary

For persistent changes, remove the --temporary flag. However, if you suspect the firewall is blocking specific destinations, use curl -v to see where the connection drops. If it connects to port 80 but fails on 443, the issue is likely SSL-related rather than network-level. Avoid suggesting permanent firewall disablement as a solution, as this compromises server security.

Resolving SSL/TLS Handshake Errors

SSL errors are frequent on fresh RHEL8 installations. The error message typically resembles "server certificate verification failed." This occurs when the local CA bundle is outdated or misconfigured. Use verbose mode to diagnose the specific failure point:

curl -v https://example.com

Look for lines indicating certificate validation failures. If the error persists after updating ca-certificates, consider whether the server requires a specific certificate chain. In some enterprise environments, internal PKI roots must be added manually to the trust store located at /etc/pki/tls/certs/ca-bundle.crt. For temporary debugging, you can bypass verification (not recommended for production):

curl -k https://example.com

This flag skips host verification. If this works, the issue is strictly related to certificate trust. Update your CA bundle instead of relying on -k long-term. For more details on handling GnuTLS handshake issues, refer to our guide on [CURL Error on Gnutls Handshake](/news/1501474/curl-gnutls-handshake).

Alternative Tools and Scripting Considerations

When curl remains problematic, wget serves as a reliable alternative for downloading files. Both tools share similar syntax but differ in behavior regarding redirects and resume capabilities. To download a file using wget:

wget https://example.com/file.tar.gz

In shell scripts, capturing the filename from headers is crucial for automation. You can extract the filename using header parsing techniques. See our article on [Catching Download File Name with wget/curl Command in Shell Script](/news/1485446/catching-download-file-name) for advanced scripting examples. Ensure that both tools are configured consistently within your environment. If you are running services behind a proxy, both curl and wget require environment variables like HTTP_PROXY and HTTPS_PROXY to function correctly. Misconfigured proxies are another common source of "connection refused" errors.

Checking Proxy Configuration

Enterprise environments often route traffic through proxies. If curl fails with a connection timeout, verify proxy settings. Check environment variables:

env | grep -i proxy

If proxies are set, test connectivity directly:

curl -x http://proxy-server:port https://example.com

If this succeeds, the issue lies with global proxy configurations. Review /etc/profile.d/proxy.sh or user-specific shell profiles for incorrect entries. Incorrect proxy URLs or authentication failures will cause immediate connection drops.

Frequently Asked Questions

Why does curl return "Could not resolve hostname"?

This error indicates a DNS resolution failure rather than a problem with curl itself. Check your /etc/resolv.conf file to ensure valid nameservers are configured. Verify network connectivity by pinging the IP address directly to isolate DNS issues.

Is it safe to disable firewalld completely?

Disabling firewalld permanently removes a critical layer of security, exposing your RHEL8 server to unauthorized access. Instead, configure specific ports and protocols using firewall-cmd rules. This approach maintains security while allowing necessary traffic for curl operations.

How do I fix SSL certificate errors without using -k?

Update the ca-certificates package to ensure your system trusts current certificate authorities. Run dnf update ca-certificates and refresh the trust store. If using an internal PKI, add your organization's root certificates to the system trust store manually.

What is the difference between curl and wget for scripting?

curl is more flexible for API interactions and supports various protocols, while wget is simpler for recursive downloads and resuming interrupted transfers. Choose curl for complex HTTP headers and authentication, and wget for straightforward file retrieval tasks.

Can Dockerized applications affect host curl functionality?

Docker containers operate in isolated networks and do not directly interfere with host-level curl commands. However, if your application relies on external databases or clients, ensure proper network bridge configurations. Refer to guides on connecting Dockerized servers to external resources for network troubleshooting.