How to debug SSL handshake using cURL?

Question

I would like to troubleshoot per directory authentication with client certificate. I would specially like to find out which acceptable client certificates does server send.<

Answer 1

1. For TLS handshake troubleshooting please use openssl s_client instead of curl.
2. -msg does the trick!
3. -debug helps to see what actually travels over the socket.
4. -status OCSP stapling should be standard nowadays.

openssl s_client -connect example.com:443 -tls1_2 -status -msg -debug -CAfile  -key  -cert  

Other useful switches -tlsextdebug -prexit -state

https://www.openssl.org/docs/man1.0.2/man1/s_client.html