I was evaluating some SSL failures, and noticed that when I use curl to one of the failing sites, I got curl: (56) SSL read: errno -5961; however, my google queries for that error didn't show the reason for the openssl failure.

Question: What does it mean when curl fails with curl: (56) SSL read: errno -5961?

I'm including the complete curl below...

[mpenning@mpenning-lnx ~]$ curl -vk
* About to connect() to port 443 (#0)
*   Trying connected
* Connected to ( port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* warning: ignoring value of ssl.verifyhost
* skipping SSL peer certificate verification
* SSL connection using TLS_RSA_WITH_AES_256_CBC_SHA
* Server certificate:
*       subject: CN=foo-console,L=New York,OU=IT Infrastructure,O=Sesame Street
*       start date: Aug 21 23:36:51 2013 GMT
*       expire date: Aug 21 23:36:51 2015 GMT
*       common name: foo-console
*       issuer: CN=foo-console,L=New York,OU=IT Infrastructure,O=Sesame Street
> GET / HTTP/1.1
> User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/ zlib/1.2.3 libidn/1.18 libssh2/1.4.2
> Host:
> Accept: */*
< HTTP/1.1 200 OK
* SSL read: errno -5961
* Closing connection #0
curl: (56) SSL read: errno -5961
[mpenning@mpenning-lnx ~]$


I am answering my own question, in hopes of helping future googlers.


The root cause of the issue wound up being a layer2 MTU mismatch, which caused the openssl socket to time out part of the way through the curl transaction. Full MTU-sized packets (i.e. 1500 byte IP payloads) failed because one side of the layer2 tunnel would not allow them through.

Other people seeing this error may not have an MTU mismatch, but it could be anything that causes an SSL session to timeout part of the way through the curl.

  • May I know how you fix your issue? Thank you. – user246363 Oct 2 '14 at 22:53
  • @jngshl, I noticed that there was an MTU mismatch (which I discovered by using the tracepath command). Then I simply made the MTU match throughout the whole Vlan. – Mike Pennington Oct 3 '14 at 10:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.