diff --git a/src/libstore/filetransfer.cc b/src/libstore/filetransfer.cc
index 68ead1d82..a840dd647 100644
--- a/src/libstore/filetransfer.cc
+++ b/src/libstore/filetransfer.cc
@@ -63,6 +63,8 @@ struct curlFileTransfer : public FileTransfer
 
         std::unique_ptr<curl_slist, decltype([](auto * s) { curl_slist_free_all(s); })> requestHeaders;
         std::unique_ptr<CURL, decltype([](auto * c) { curl_easy_cleanup(c); })> req;
+        // buffer to accompany the `req` above
+        char errbuf[CURL_ERROR_SIZE];
 
         inline static const std::set<long> successfulStatuses {200, 201, 204, 206, 304, 0 /* other protocol */};
         /* Get the HTTP status code, or 0 for other protocols. */
@@ -137,6 +139,9 @@ struct curlFileTransfer : public FileTransfer
             curl_easy_setopt(req.get(), CURLOPT_PROGRESSDATA, this);
             curl_easy_setopt(req.get(), CURLOPT_NOPROGRESS, 0);
 
+            curl_easy_setopt(req.get(), CURLOPT_ERRORBUFFER, errbuf);
+            errbuf[0] = 0;
+
             curl_easy_setopt(req.get(), CURLOPT_PROTOCOLS_STR, "http,https,ftp,ftps");
 
             curl_easy_setopt(req.get(), CURLOPT_HTTPHEADER, requestHeaders.get());
@@ -397,8 +402,8 @@ struct curlFileTransfer : public FileTransfer
                         code == CURLE_OK ? "" : fmt(" (curl error: %s)", curl_easy_strerror(code)))
                     : FileTransferError(err,
                         std::move(response),
-                        "unable to %s '%s': %s (%d)",
-                        verb(), uri, curl_easy_strerror(code), code);
+                        "unable to %s '%s': %s (%d) %s",
+                        verb(), uri, curl_easy_strerror(code), code, errbuf);
 
                 fail(std::move(exc));
             }
diff --git a/tests/nixos/fetchurl.nix b/tests/nixos/fetchurl.nix
index 97365d053..719405be5 100644
--- a/tests/nixos/fetchurl.nix
+++ b/tests/nixos/fetchurl.nix
@@ -76,7 +76,7 @@ in
     # Fetching from a server with an untrusted cert should fail.
     err = machine.fail("nix build --no-substitute --expr 'import <nix/fetchurl.nix> { url = \"https://bad/index.html\"; hash = \"sha256-rsBwZF/lPuOzdjBZN2E08FjMM3JHyXit0Xi2zN+wAZ8=\"; }' 2>&1")
     print(err)
-    assert "SSL certificate problem: self-signed certificate" in err or "SSL peer certificate or SSH remote key was not OK" in err
+    assert "SSL certificate problem: self-signed certificate" in err
 
     # Fetching from a server with a trusted cert should work via environment variable override.
     machine.succeed("NIX_SSL_CERT_FILE=/tmp/cafile.pem nix build --no-substitute --expr 'import <nix/fetchurl.nix> { url = \"https://bad/index.html\"; hash = \"sha256-rsBwZF/lPuOzdjBZN2E08FjMM3JHyXit0Xi2zN+wAZ8=\"; }'")