check_curl's help says that -u accepts a URL,

 check_curl -H <vhost> | -I <IP-address> [-u <uri>] [-p <port>]

 -u, --url=PATH
    URL to GET or POST (default: /)

but if you pass actually pass a URL rather than just a path, it tries to do an HTTP CONNECT, rather than just a GET.

$ /usr/lib/nagios/plugins/check_curl -H www.monitoring-plugins.org -u https://www.monitoring-plugins.org/doc/man/check_curl.html
HTTP CRITICAL - Invalid HTTP response received from host on port 80: cURL returned 56 - CONNECT tunnel failed, response 400

I was trying to connect to a particular server but override the hostname (to test each server in a group that has a shared hostname for failover), by passing the real hostname but the shared URL, but this failed. (eg check_curl -H server1.server.com -u https://www.server.com/alive).

The correct solution was to pass the shared hostname in -H, only a path in -u, and the actual hostname to -I (check_curl -H www.server.com -u /alive -I server1.server.com).