Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Let's say a website is load-balanced between several servers. I want to run a command to test whether it's working, such as curl DOMAIN.TLD. So, to isolate each IP address, I specify the IP manually. But many websites may be hosted on the server, so I still provide a host header, like this: curl IP_ADDRESS -H 'Host: DOMAIN.TLD'. In my understanding, these two commands create the exact same HTTP request. The only difference is that in the latter one I take out the DNS lookup part from cURL and do this manually (please correct me if I'm wrong).

All well so far. But now I want to do the same for an HTTPS url. Again, I could test it like this curl https://DOMAIN.TLD. But I want to specify the IP manually, so I run curl https://IP_ADDRESS -H 'Host: DOMAIN.TLD'. Now I get a cURL error:

curl: (51) SSL: certificate subject name 'DOMAIN.TLD' does not match target host name 'IP_ADDRESS'.

I can of course get around this by telling cURL not to care about the certificate (the "-k" option) but it's not ideal.

Is there a way to isolate the IP address being connected to from the host being certified by SSL?

share|improve this question

Think I found a solution going through the cURL manual:

curl https:// DOMAIN.TLD --resolve 'DOMAIN.TLD:443:IP_ADDRESS'

share|improve this answer
--resolve doe not exist in curl... – user1571299 Sep 10 '14 at 13:07
The curl on my machine (7.27.0) has --resolve. – Theron Luhn Jan 16 '15 at 17:41
You can see it work using curl -v and you can see that curl adds the resolve option to the DNS cache temporariy, and adds uses the IP address you specified. – CMCDragonkai Oct 19 '15 at 5:13

You can change in /etc/hosts to make the server think that the domain is located at a certain IP.

This is the syntax: www.domain.tld

This will make cURL use the IP-address you want without the SSL-certificate to break.

share|improve this answer
That works, but I'm looking at some method which doesn't require modifying the OS as a whole – Martin Oct 31 '12 at 9:35
I honestly don't think there's another way. You must get cURL to access the correct domain-name for the certificate to work, and the way to map a certain domain to an IP is either by DNS or by the hosts-file. – miono Oct 31 '12 at 10:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.