Was stuck with this error doing a casual activity: Downloading android ndk... curl --fail --retry 3 -o ndk.zip https://dl.google.com/android/repository/android-ndk-r23b-linux.zip % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 88 691M 88 609M 0 0 67.2M 0 0:00:10 0:00:09 0:00:01 63.9M curl: (56) OpenSSL SSL_read: error:1408F119:SSL routines:ssl3_get_record:decryption fail ed or bad record mac, errno 0 The error means the ssl stream has been mutated, possibly by a third party. Note: it's hard for me to believe that, I kind of just feel it as paranoid fear. I got it every time I tried the download, at about the same amount into the stream. I think there are better solutions for routing, like cjdns or something, where connects are solid and prevent such things. Not set up with them. $ host dl.google.com dl.google.com has address 142.250.80.110 dl.google.com has IPv6 address 2607:f8b0:4006:80d::200e I went on the web to get other information on the ip address of dl.google.com and ended up at whatismyipaddress.com, which also has host lookup. It said the ip address was 142.250.72.238 . Since it starts with the same two numbers, I figured it was just some load balancing system. $ cat /etc/resolv.conf nameserver 8.8.8.8 nameserver 208.67.222.222 nameserver 1.1.1.1 nameserver 84.200.69.80 I tried each nameserver in sequence like: $ host dl.google.com 8.8.8.8 for each one. The first three gave the same ip address that fails for me, each request, which seems strange to me for a load balancing system. The fourth gave a different ip address. I have 172.217.19.238 in my scrollback history but presently am getting 142.251.36.14 . I moved this nameserver to the top of my list and the download finally completed successfully. This could be a coincidence, but didn't seem one at the time.