# Curl: (35) TCP connection reset by peer
**URL:** https://community.letsencrypt.org/t/curl-35-tcp-connection-reset-by-peer/193129
**Category:** Help
**Created:** [February 20, 2023, 10:29am UTC](https://community.letsencrypt.org/t/curl-35-tcp-connection-reset-by-peer/193129 "2023-02-20T10:29:08Z")
**Posts on this page:** 15
**Page:** 1
### Author:  [@jandreolivier](https://community.letsencrypt.org/u/jandreolivier)
#### Post date: [February 20, 2023, 10:29am UTC](https://community.letsencrypt.org/t/curl-35-tcp-connection-reset-by-peer/193129/1 "2023-02-20T10:29:08Z")
HI Guys
Been struggling for a while, not sure what im doing wrong
Please assist, any help will be appreciated
seems to be only cloud fare that fails, I've checked every possible firewall issue
our Plesk server is failing to issue certificates from these 2 ips
i get this error when testing curl
my Ipv4 is 41.87.196.29 and 102.130.80.29
curl -v [https://acme-v02.api.letsencrypt.org](https://acme-v02.api.letsencrypt.org/)
- About to connect() to [acme-v02.api.letsencrypt.org](http://acme-v02.api.letsencrypt.org/) port 443 (#0)
- Trying 172.65.32.248...
- Connected to [acme-v02.api.letsencrypt.org](http://acme-v02.api.letsencrypt.org/) (172.65.32.248) port 443 (#0)
- Initializing NSS with certpath: sql:/etc/pki/nssdb
- CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
- NSS error -5961 (PR\_CONNECT\_RESET\_ERROR)
- TCP connection reset by peer
- Closing connection 0
curl: (35) TCP connection reset by peer
Many Thanks
J
---
### Author:  [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)
#### Post date: [February 20, 2023, 1:11pm UTC](https://community.letsencrypt.org/t/curl-35-tcp-connection-reset-by-peer/193129/2 "2023-02-20T13:11:32Z")
Welcome @jandreolivier
Can you show result of these:
```plaintext
echo | openssl s_client -connect acme-v02.api.letsencrypt.org:443 | head
curl https://www.cloudflare.com/cdn-cgi/trace
curl https://google.com
```
---
### Author:  [@rg305](https://community.letsencrypt.org/u/rg305)
#### Post date: [February 20, 2023, 6:08pm UTC](https://community.letsencrypt.org/t/curl-35-tcp-connection-reset-by-peer/193129/3 "2023-02-20T18:08:50Z")
> [@jandreolivier](#):
>
> seems to be only cloud fare that fails
Please show the route table:
`netstat -nr`
---
### Author:  [@jandreolivier](https://community.letsencrypt.org/u/jandreolivier)
#### Post date: [February 20, 2023, 6:41pm UTC](https://community.letsencrypt.org/t/curl-35-tcp-connection-reset-by-peer/193129/4 "2023-02-20T18:41:30Z")
Here is results, thank you
`echo | openssl s_client -connect acme-v02.api.letsencrypt.org:443 | head`
```plaintext
write:errno=104
CONNECTED(00000003)
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 289 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
```
`curl https://www.cloudflare.com/cdn-cgi/trace`
`curl: (35) TCP connection reset by peer`
`curl https://google.com`
```plaintext
301 Moved
301 Moved
The document has moved
here.
```
---
### Author:  [@jandreolivier](https://community.letsencrypt.org/u/jandreolivier)
#### Post date: [February 20, 2023, 6:42pm UTC](https://community.letsencrypt.org/t/curl-35-tcp-connection-reset-by-peer/193129/5 "2023-02-20T18:42:59Z")
> [@rg305](#):
>
> netstat -nr
netstat -nr
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 41.87.196.17 0.0.0.0 UG 0 0 0 eth0
41.87.196.16 0.0.0.0 255.255.255.240 U 0 0 0 eth0
---
### Author:  [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)
#### Post date: [February 20, 2023, 6:49pm UTC](https://community.letsencrypt.org/t/curl-35-tcp-connection-reset-by-peer/193129/6 "2023-02-20T18:49:10Z")
> [@jandreolivier](#):
>
> Here is results, thank you
Which IP was that from?
Do you get same results from both IP in post #1?
ADD:
And, given this:
> [@jandreolivier](#):
>
> curl [https://www.cloudflare.com/cdn-cgi/trace](https://www.cloudflare.com/cdn-cgi/trace)
> curl: (35) TCP connection reset by peer
What happens if you access `https://www.cloudflare.com` from a browser? Do you get any kind of Captcha page or something?
---
### Author:  [@rg305](https://community.letsencrypt.org/u/rg305)
#### Post date: [February 20, 2023, 9:32pm UTC](https://community.letsencrypt.org/t/curl-35-tcp-connection-reset-by-peer/193129/7 "2023-02-20T21:32:58Z")
What shows?:
`curl https://beer4.work/cipher.html`
---
### Author:  [@jandreolivier](https://community.letsencrypt.org/u/jandreolivier)
#### Post date: [February 21, 2023, 12:26am UTC](https://community.letsencrypt.org/t/curl-35-tcp-connection-reset-by-peer/193129/8 "2023-02-21T00:26:34Z")
curl [https://beer4.work/cipher.html](https://beer4.work/cipher.html)
Cipher = TLSv1.2/ECDHE-ECDSA-AES256-GCM-SHA384
IP address = 41.87.196.29
User Agent = "curl/7.29.0"
---
### Author:  [@jandreolivier](https://community.letsencrypt.org/u/jandreolivier)
#### Post date: [February 21, 2023, 12:33am UTC](https://community.letsencrypt.org/t/curl-35-tcp-connection-reset-by-peer/193129/9 "2023-02-21T00:33:25Z")
> [@MikeMcQ](#):
>
> Which IP was that from?
IP address = 41.87.196.29
Im not getting a captcha from my pc, however its not on the same network as the hosting server, not sure how to check command line if get one on remote server
---
### Author:  [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)
#### Post date: [February 21, 2023, 1:47am UTC](https://community.letsencrypt.org/t/curl-35-tcp-connection-reset-by-peer/193129/10 "2023-02-21T01:47:33Z")
> [@jandreolivier](#):
>
> Im not getting a captcha from my pc,
I was hoping you had a browser on the failing IP. At least some Cloudflare blocks will apparently show you a Captcha screen where you can prove you are a nice human and not a bad bot.
I understand if you don't have a browser on the server though.
The failing connect to Cloudflare likely means it is not a Let's Encrypt problem. Except of course that LE uses Cloudflare so you can't get to LE.
I'm not sure what to do. Hopefully another volunteer will. Maybe Rudy.
---
### Author:  [@webprofusion](https://community.letsencrypt.org/u/webprofusion)
#### Post date: [February 21, 2023, 2:53am UTC](https://community.letsencrypt.org/t/curl-35-tcp-connection-reset-by-peer/193129/11 "2023-02-21T02:53:14Z")
I'd guess it's just that the IP is blocked, or it previously did something to flag itself as a bot to Cloudflare. Just try a different CA (like ZeroSSL or BuyPass Go).
---
### Author:  [@jandreolivier](https://community.letsencrypt.org/u/jandreolivier)
#### Post date: [February 21, 2023, 4:36am UTC](https://community.letsencrypt.org/t/curl-35-tcp-connection-reset-by-peer/193129/12 "2023-02-21T04:36:55Z")
Thanks so much for all the advice and info, ill try and ssh tunnel in and route myself through the server to see if get a captcha.
Thanks guys
---
### Author:  [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)
#### Post date: [February 21, 2023, 1:26pm UTC](https://community.letsencrypt.org/t/curl-35-tcp-connection-reset-by-peer/193129/13 "2023-02-21T13:26:35Z")
What does this show?
```plaintext
sudo traceroute -T -p 443 acme-v02.api.letsencrypt.org
```
and maybe compare to this
```plaintext
sudo traceroute -T -p 443 www.cloudflare.com
```
---
### Author:  [@jandreolivier](https://community.letsencrypt.org/u/jandreolivier)
#### Post date: [February 21, 2023, 3:38pm UTC](https://community.letsencrypt.org/t/curl-35-tcp-connection-reset-by-peer/193129/14 "2023-02-21T15:38:27Z")
Ok after involving my upstream peering ISP, and ssh tunnel proxy in and testing with a browser, looks like the upstream vendor is having some routing issues, They changed the way its routing and now it resolved and all my certs updated and connection reset is gone. Thanks you again all for the quick help
Cheers
J
---
### Author:  [@system](https://community.letsencrypt.org/u/system)
#### Post date: [March 23, 2023, 3:39pm UTC](https://community.letsencrypt.org/t/curl-35-tcp-connection-reset-by-peer/193129/15 "2023-03-23T15:39:05Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.