Although it's related to HTTPS = TLS, I'm not sure this is really a security question. OTOH I don't know how to migrate and am not sure where would be better.
What is the meaning of TLSv1.2 (OUT), TLS alert, Client hello (1) after the connection is closed, is it trying to reconnect?
It's not after closing, it is part of closing, i.e. it is after initiating close. Specifically, the TLS client stack sends an alert record with level=1 (warning) in the first byte and description=0 (close_notify) in the second byte; this is a normal part of a client-initiated TLS close. The callback curl uses to log protocol actions (when requested with
-v) lamely decodes all records as handshake records (even though here it correctly identifies the record as an alert record) so it misdecodes the first byte as a handshake message type (1=Client Hello).
Is it being sent by the server, or by the client? If by the client then is it being sent by openssl or curl?
It is sent by the client (curl is the client and OUT is sending). It is sent by the TLS stack used by curl, which isn't always OpenSSL, although it may be here. Unless you know for sure e.g. because you built it yourself, you can check with
curl -V (uppercase vee) which stack your build of curl uses.
I have seen some curl outputs which don't have the string and Closing connection 0 is the last output, what does that mean?
curl should always log 'Closing connection' if you have specified
-v (and not otherwise). It may not log the 'OUT ... alert ... 1' if either it is using a stack without the callback (which AFAIK could be anything other than OpenSSL) OR the server has closed quickly enough (like, immediately) after the end of data so that the client stack doesn't need to and can't notify the server -- or even before the end of data, but that should give an error indicating the data is incomplete. And of course even when
curl does issue these outputs, it writes to stderr which in most environments can be redirected or discarded.