mac终端走代理curl报错：tlsv1 alert decode error

[fwanany]

参考小小白话文搭建的xtls+rprx+vision，服务端和客户端版本均为1.7.5。

mac终端走代理，下载homebrew时，curl报错如下：

curl: (35) LibreSSL/3.3.6: error:1404B41A:SSL routines:ST_CONNECT:tlsv1 alert decode error。   

麻烦大佬帮忙看看是什么原因，谢谢🙏！

服务端配置和客户端配置如下（ip地址等关键信息已隐藏）：
服务端：

{
  "log": {
    "loglevel": "warning",
    "access": "/home/happy/xray_log/access.log",
    "error": "/home/happy/xray_log/error.log"
  },

  "dns": {
    "servers": [
      "https+local://1.1.1.1/dns-query",
      "localhost"
    ]
  },

  "routing": {
    "domainStrategy": "IPIfNonMatch",
    "rules": [
      {
        "type": "field",
        "ip": [
          "geoip:private"
        ],
        "outboundTag": "block"
      },
      {
        "type": "field",
        "ip": ["geoip:cn"],
        "outboundTag": "block"
      },
      {
        "type": "field",
        "domain": [
          "geosite:category-ads-all"
        ],
        "outboundTag": "block"
      }
    ]
  },
  "inbounds": [
    {
      "port": 443,
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id": "",
            "flow": "xtls-rprx-vision",
            "level": 0,
            "email": ""
          }
        ],
        "decryption": "none",
        "fallbacks": [
          {
            "dest": 8080
          }
        ]
      },
      "streamSettings": {
        "network": "tcp",
        "security": "tls",
        "tlsSettings": {
          "alpn": "http/1.1",
          "certificates": [
            {
              "certificateFile": "/home/happy/xray_cert/xray.crt",
              "keyFile": "/home/happy/xray_cert/xray.key"
            }
          ]
        }
      }
    }
  ],
  "outbounds": [
    {
      "tag": "direct",
      "protocol": "freedom"
    },
    {
      "tag": "block",
      "protocol": "blackhole"
    }
  ]
}

客户端配置：

{
  "log": {
    "access": "/Users/fwany/Xray/access.log",
    "error": "/Users/fwany/Xray/error.log",
    "loglevel": "warning"
  },

  "dns": {
    "servers": [
      {
        "address": "1.1.1.1",
        "domains": ["geosite:geolocation-!cn"]
      },
      {
        "address": "223.5.5.5",
        "domains": ["geosite:cn"],
        "expectIPs": ["geoip:cn"]
      },
      {
        "address": "114.114.114.114",
        "domains": ["geosite:cn"]
      },
      "localhost"
    ]
  },

  "routing": {
    "domainStrategy": "IPIfNonMatch",
    "rules": [
      {
        "type": "field",
        "domain": ["geosite:category-ads-all"],
        "outboundTag": "block"
      },
      {
        "type": "field",
        "domain": ["geosite:cn"],
        "outboundTag": "direct"
      },
      {
        "type": "field",
        "ip": ["geoip:cn", "geoip:private"],
        "outboundTag": "direct"
      },
      {
        "type": "field",
        "domain": ["geosite:geolocation-!cn"],
        "outboundTag": "proxy"
      },
      {
        "type": "field",
        "ip": ["223.5.5.5"],
        "outboundTag": "direct"
      }
    ]
  },

  "inbounds": [
    {
      "tag": "socks-in",
      "protocol": "socks",
      "listen": "127.0.0.1",
      "port": 1080,
      "settings": {
        "udp": true
      }
    },
    {
      "tag": "http-in",
      "protocol": "http",
      "listen": "127.0.0.1",
      "port": 1081
    }
  ],

  "outbounds": [
    {
      "tag": "proxy",
      "protocol": "vless",
      "settings": {
        "vnext": [
          {
            "address": "",
            "port": 443,
            "users": [
              {
                "id": "",
                "flow": "xtls-rprx-vision",
                "encryption": "none",
                "level": 0
              }
            ]
          }
        ]
      },
      "streamSettings": {
        "network": "tcp",
        "security": "tls",
        "tlsSettings": {
          "serverName": "",
          "allowInsecure": false,
          "fingerprint": "chrome"
        }
      }
    },
    {
      "tag": "direct",
      "protocol": "freedom"
    },
    {
      "tag": "block",
      "protocol": "blackhole"
    }
  ]
}

[KinglyWayne]

大概率为服务端证书过期
修改客户端配置为"allowInsecure": true

[luyang93]

好像并不是证书过期的问题
服务端使用all in one fallback nginx，客户端从Vless-TCP-XTLS更换为Vless-WS-TLS便不会出现curl报错