Revision history  [back]

Both "Encrypted Alert" after the "Application data" are most likely a "TLS Close Notify". If the server sends a "HTTP 400" on HTTP level, than it makes sense it also closes the TLS layer after that (Encrypted Alert), followed by closing the TCP connection (the FIN).

"Application data" (= HTTP request or response) is only possible after a successful TLS handshake.

The TCP Reset is just a unclean shutdown of the TCP connection by the client.

The --verbose option of curl will show the TLS and HTTP communication.