How do I test an HTTPS origin server before changing DNS?
curl --resolve lets one request connect to a chosen IP while using the intended hostname for HTTP and TLS. This is useful when validating a replacement server before a DNS change. It only affects that curl invocation and does not update the computer’s DNS settings.
Before you start
- The approved origin IP and hostname.
- A valid certificate for that hostname already installed on the new TLS endpoint.
- Permission to connect directly to the origin.
Instructions
1. Test the selected HTTPS endpoint
Substitute the same hostname in both places. The port in --resolve must match the URL’s connection port.
curl.exe --head --resolve app.example.com:443:203.0.113.10 --connect-timeout 5 --max-time 15 https://app.example.com/From Windows PowerShell, routes this HTTPS request to the example origin without disabling certificate validation.
2. Inspect a safe application route
Repeat for representative read-only routes and static assets. Check the expected page content and authentication flow through an approved test account where needed; a successful home-page HEAD is not a full migration test.
3. Account for intermediaries
A configured HTTP proxy can change the connection path, and a CDN-protected origin may reject direct access by design. Test through the approved network path and record whether the result came from the origin or an intermediary.
Check the result
- The selected origin serves the correct hostname, valid certificate and expected content for representative routes.
Troubleshooting
- The request redirects to a different hostname
- Add a separate approved test mapping for that hostname if it also belongs on the new origin. The first mapping does not automatically cover every redirect destination.
- TLS fails for the new origin
- Fix the hostname certificate or chain before cutover; do not treat an insecure curl result as readiness.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.