OPENSSL-LIST(1ossl)

💅 OPENSSL-LIST(1ossl) — the openssl-list manual, but make it make sense

okay so bestie, this is the <italic>openssl-list</italic> page from the OpenSSL 3.5.0 fam — it's the "what can this thing even DO" command. Like a vibe check for every algorithm on your box. Let's get into it 🌸

---

✨ SYNOPSIS ✨

openssl list [-help] [-verbose] [-select name] [-1] [-all-algorithms]
[-commands] [-standard-commands] [-digest-algorithms] [-digest-commands]
[-kdf-algorithms] [-mac-algorithms] [-random-instances]
[-random-generators] [-cipher-algorithms] [-cipher-commands] [-encoders]
[-decoders] [-key-managers] [-skey-managers] [-key-exchange-algorithms]
[-kem-algorithms] [-tls-groups] [-all-tls-groups] [-tls1_2] [-tls1_3]
[-signature-algorithms] [-tls-signature-algorithms]
[-asymcipher-algorithms] [-public-key-algorithms] [-public-key-methods]
[-store-loaders] [-providers] [-engines] [-disabled] [-objects]
[-options command] [-provider name] [-provider-path path] [-provparam
[name:]key=value] [-propquery propq]

🦋 DESCRIPTION 🦋

bestie. this command literally just generates a list of algorithms, or a list of the disabled features (the stuff that got compiled out of your install). that's it. that's the whole job. and honestly? iconic behavior. 👑

---

🎀 OPTIONS 🎀

• -help — prints the usage message so you stop guessing. love that for you.
• -verbose — gives you extra info. the options below that say verbosity applies will explain a bit more about what "extra" actually means. no cap.
• -select name — only lists the algorithms that match name. like a filter, but fancy.
• -1 — lists the commands, digest-commands, or cipher-commands in a single column. ⚠️ and if you use it, it must be given first. no negotiating.
• -all-algorithms — displays lists of all the algorithms, which includes:
  • Asymmetric ciphers
  • Decoders
  • Digests
  • Encoders
  • Key derivation algorithms (KDF)
  • Key encapsulation methods (KEM)
  • Key exchange algorithms (KEX)
  • Key managers
  • Symmetric key managers
  • Message authentication code algorithms (MAC)
  • Random number generators (RNG, DRBG)
  • Signature algorithms
  • Store loaders
  • Symmetric ciphers
• -commands — displays a list of standard commands. the classics.
• -standard-commands — same energy: a list of standard commands.
• -digest-commands — 💀 deprecated bestie. use -digest-algorithms instead. (it displays a list of message digest commands, which are typically used as input to the openssl-dgst(1) or openssl-speed(1) commands.)
• -cipher-commands — also deprecated 😭 use -cipher-algorithms instead. (displays a list of cipher commands, which are typically used as input to the openssl-enc(1) or openssl-speed(1) commands.)
• -cipher-algorithms, -digest-algorithms, -kdf-algorithms, -mac-algorithms — displays lists of symmetric cipher, digest, kdf and mac algorithms. see "Display of algorithm names" for how the names get shown. in verbose mode, algorithms provided by a provider get extra info on what parameters each implementation supports. 🫶
• -random-instances — lists the primary, public and private random number generator details. rng lore.
• -random-generators — displays a list of random number generators. again, see "Display of algorithm names" for how names are displayed.
• -encoders — displays a list of encoders. see "Display of algorithm names" for the naming. in verbose mode, algorithms provided by a provider get extra info on what parameters each implementation supports.
• -decoders — displays a list of decoders. see "Display of algorithm names" for the naming. in verbose mode, algorithms provided by a provider get extra info on what parameters each implementation supports.
• -public-key-algorithms — displays a list of public key algorithms, with each algorithm as a block of multiple lines, and all but the first line are indented. the options key-exchange-algorithms, kem-algorithms, signature-algorithms, and asymcipher-algorithms will display similar info.
• -public-key-methods — displays a list of public key methods.
• -key-managers — displays a list of key managers.
• -skey-managers — displays a list of symmetric key managers.
• -key-exchange-algorithms — displays a list of key exchange algorithms.
• -kem-algorithms — displays a list of key encapsulation algorithms.
• -tls-groups — displays a list of the IANA names of all available (implemented) TLS groups. by default, the listed groups are the ones compatible with TLS 1.3.
• -all-tls-groups — displays a list of the names of all available (implemented) TLS groups, including any aliases. some groups are known under multiple names — for example, secp256r1 is also known as P-256. by default, the listed groups are those compatible with TLS 1.3.
• -tls1_2 — when listing TLS groups, lists the ones compatible with TLS 1.2.
• -tls1_3 — when listing TLS groups, outputs the ones compatible with TLS 1.3. TLS 1.3 is the current default protocol version, but the default version is subject to change, so best to specify the version explicitly. (fr fr, be explicit. future you will thank you.)
• -signature-algorithms — displays a list of signature algorithms.
• -tls-signature-algorithms — displays the list of signature algorithms available for TLS handshakes, made available by all currently active providers. the output format is colon delimited, in a form directly usable in SSL_CONF_cmd(3) when specifying SignatureAlgorithms. slay.
• -asymcipher-algorithms — displays a list of asymmetric cipher algorithms.
• -store-loaders — displays a list of store loaders.
• -providers — displays a list of all loaded providers with their names, version and status. in verbose mode, the full version and all provider parameters get displayed too. 🧚
• -engines — deprecated bestie 💀 displays a list of loaded engines.
• -disabled — displays a list of disabled features, i.e. the ones that were compiled out of the installation.
• -objects — displays a list of built in objects, i.e. OIDs with names. they're listed in the format described in "ASN1 Object Configuration Module" in config(5).
• -options command — outputs a two-column list of the options accepted by the specified command. the first column is the option name, and the second is a one-character indication of what type of parameter it takes, if any. this is an internal option, used for checking that the documentation is complete. (yes, it's checking up on the docs. iconic.)
• -provider name, -provider-path path, -provparam [name:]key=value, -propquery propq — see "Provider Options" in openssl(1), provider(7), and property(7). 🌈

💜 Display of algorithm names 💜

algorithm names get displayed in one of two manners, depending on the vibe:

🌸 Legacy implementations

legacy implementations will simply display the main name of the algorithm on a line of its own, or in the form "<foo " bar>> to show that "foo" is an alias for the main name, "bar".

⭐ Provided implementations

implementations from a provider are displayed like this if the implementation is labeled with a single name:

 foo @ bar

or like this if it's labeled with multiple names:

 { foo1, foo2 } @bar

in both cases, "bar" is the name of the provider. iykyk. 💅

---

🎀 HISTORY 🎀

the -engines, -digest-commands, and -cipher-commands options were deprecated in OpenSSL 3.0. 😭

the -skey-managers option was added in OpenSSL 3.5. ✨

👑 COPYRIGHT 👑

Copyright 2016-2025 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

okay that's the whole page bestie, go list some algorithms 💖

version 3.5.0 · dated 2026-09-25 · OPENSSL-LIST(1ossl) — periodt 🫶