* Host service.local.example.tld:443 was resolved.
* IPv6: (none)
* IPv4: 1.2.3.4
*   Trying 1.2.3.4:443...
* Connected to service.local.example.tld (1.2.3.4) port 443
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519 / id-ecPublicKey
* ALPN: server accepted http/1.1
* Server certificate:
*  subject: CN=*.local.example.tld
*  start date: Dec  8 23:15:25 2025 GMT
*  expire date: Mar  8 23:15:24 2026 GMT
*  issuer: C=US; O=Let's Encrypt; CN=E8
*  SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
*   Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
*   Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using sha256WithRSAEncryption
* using HTTP/1.x
> GET /web HTTP/1.1
> Host: service.local.example.tld
> User-Agent: curl/8.5.0
> Accept: */*
>
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
< HTTP/1.1 301 Moved Permanently
< Server: openresty
< Date: Wed, 10 Dec 2025 20:46:46 GMT
< Content-Length: 0
< Connection: keep-alive
< Location: http://service.invalid.tld/web/
< X-Response-Time-ms: 1
< Alt-Svc: h3=":443"; ma=86400
< X-XSS-Protection: 0
< X-Content-Type-Options: nosniff
< X-Frame-Options: SAMEORIGIN
< Content-Security-Policy: upgrade-insecure-requests
< Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
<
* Connection #0 to host service.local.example.tld left intact