curl Proxy Timeouts: Finding the Failed Step
Separate proxy connection setup, tunnel negotiation, TLS, and a stalled response so that curl timeout settings help identify the problem.
Find the last completed operation in curl's verbose output. “Connected to the proxy, but no CONNECT response” narrows the problem much more than “proxy timed out.”
Use a bounded request, substituting your HTTP proxy for the local example; the HTTP proxy list is one place to find alternative endpoints for comparison:
curl --noproxy '' --proxy http://127.0.0.1:8080 --connect-timeout 5 --max-time 15 --verbose https://example.com/--connect-timeout 5 gives connection setup one budget, including applicable lookups and handshakes; it does not allocate five seconds to each stage. --max-time 15 caps the overall operation, including transfer time after setup.
| Where progress stops | Investigate next |
|---|---|
| No connection to the proxy | Proxy hostname resolution, listening port, routing and firewall policy. |
| Proxy connected; no tunnel response | Proxy load, authentication negotiation, access policy and destination reachability from the proxy. |
| Tunnel accepted; TLS incomplete | Destination reachability, TLS negotiation and managed interception. |
| Destination headers arrive; body stalls | Origin transfer behavior, intermediary buffering and whether the application is intentionally quiet. |
For the underlying handshake order, see how CONNECT carries HTTPS. A stop near the connection budget suggests setup; a later stop at the overall budget suggests an incomplete transfer. Use the sequence alongside timing—timing alone cannot identify the component. Log wording varies between curl builds, and an open TCP port does not establish that CONNECT works.
Keep one side fixed
Compare the same destination over an allowed direct route:
curl --noproxy '*' --connect-timeout 5 --max-time 15 --verbose https://example.com/Then compare another harmless destination through the same proxy. If only one target fails, investigate that route or destination policy. If every target stops at the same setup step, investigate the common proxy path. Save the start time, endpoint, target and last completed stage; remove credentials, tokens, cookies and private names before sharing logs.
When a connection stays open without useful progress
A file transfer may need a low-speed limit in addition to setup and total limits:
curl --noproxy '' --proxy http://127.0.0.1:8080 --connect-timeout 5 --max-time 60 --speed-limit 100 --speed-time 20 https://example.com/This aborts when the sustained transfer rate stays below 100 bytes per second for 20 seconds, while keeping a 60-second overall cap. Select values for the workload. An event stream can be healthy during long quiet periods, so a download's rule can incorrectly abort it.
Increasing every limit postpones the symptom. Immediate repeated retries can add connections to an overloaded path. Diagnose with a few deliberate comparisons; any later application retry policy needs its own total budget and consideration of whether repeating the operation is safe.