static-curl and TLS 1.3

[prokhorovalexey]

Does static-curl have support for TLS 1.3?
I'm checking this:

bash-5.2# curl  --tlsv1.3 https://iana.org
curl: (35) TLS connect error: error:0A000119:SSL routines::decryption failed or bad record mac

Is it expected? Or may be I'm doing something incorrectly?

[travislee89]

It works fine on my side.

$ curl -V
curl 8.14.1 (x86_64-pc-linux-gnu) libcurl/8.14.1 OpenSSL/3.5.0 zlib/1.3.1 brotli/1.1.0 zstd/1.5.7 c-ares/1.34.5 libidn2/2.3.8 libpsl/0.21.5 libssh2/1.11.1 nghttp2/1.65.0 nghttp3/1.10.1
Release-Date: 2025-06-04
Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp ws wss
Features: alt-svc asyn-rr AsynchDNS brotli HSTS HTTP2 HTTP3 HTTPS-proxy HTTPSRR IDN IPv6 Largefile libz NTLM PSL SSL SSLS-EXPORT threadsafe TLS-SRP TrackMemory UnixSockets zstd

$ curl  --tlsv1.3 https://iana.org -v
* Host iana.org:443 was resolved.
* IPv6: 2001:500:88:200::8
* IPv4: 192.0.43.8
*   Trying [2001:500:88:200::8]:443...
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / x25519 / RSASSA-PSS
* ALPN: server did not agree on a protocol. Uses default.
* Server certificate:
*  subject: C=US; ST=California; O=Internet Corporation For Assigned Names and Numbers; CN=*.iana.org
*  start date: Dec  6 00:00:00 2024 GMT
*  expire date: Jan  5 23:59:59 2026 GMT
*  subjectAltName: host "iana.org" matched cert's "iana.org"
*  issuer: C=GB; ST=Greater Manchester; L=Salford; O=Sectigo Limited; CN=Sectigo RSA Organization Validation Secure Server CA
*  SSL certificate verify ok.
*   Certificate level 0: Public key type RSA (4096/152 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha384WithRSAEncryption
*   Certificate level 2: Public key type RSA (4096/152 Bits/secBits), signed using sha384WithRSAEncryption
* Connected to iana.org (2001:500:88:200::8) port 443