OPENSSL-LIST(1ossl)

📦
version 3.5.9 · 8 versions
, in alpine 3.23, alpine 3.24

💅 openssl-list — the openSSL manual, bestie edition 🎀

okay so this is openssl-list(1ossl), straight out of the OpenSSL fam. it's the page that teaches you how to make openssl list spill the tea on every algorithm and feature it's got. let's get into it ✨

✨ SYNOPSIS ✨

openssl list [-help] [-verbose] [-select name] [-1] [-all-algorithms]
[-commands] [-standard-commands] [-digest-algorithms] [-digest-commands]
[-kdf-algorithms] [-mac-algorithms] [-random-instances]
[-random-generators] [-cipher-algorithms] [-cipher-commands] [-encoders]
[-decoders] [-key-managers] [-skey-managers] [-key-exchange-algorithms]
[-kem-algorithms] [-tls-groups] [-all-tls-groups] [-tls1_2] [-tls1_3]
[-signature-algorithms] [-tls-signature-algorithms]
[-asymcipher-algorithms] [-public-key-algorithms] [-public-key-methods]
[-store-loaders] [-providers] [-engines] [-disabled] [-objects]
[-options command] [-provider name] [-provider-path path] [-provparam
[name:]key=value] [-propquery propq]

like yes, that's a lot of flags. she's an overachiever, we love that for her 💖

🌸 DESCRIPTION 🌸

this command literally exists to generate a list of algorithms or of the disabled features. that's it. that's the whole vibe. you ask, she lists. iconic behavior, no notes 🫶

👑 OPTIONS 👑

  • -help — prints a usage message so you know what's up. classic.
  • -verbose — gives you the extra info, the director's commentary, the bonus content. the options below that say verbosity applies will explain a lil more about what that actually means for them.
  • -select name — only lists algorithms that match this name. filtering, but make it fashion.
  • -1 — lists the commands, digest-commands, or cipher-commands in a single column. ⚠️ and listen: if you use it, this option must be given first. first. before everything. she's a main character who needs to enter the room before anyone else.
  • -all-algorithms — shows you lists of all the algorithms. and "all" is doing heavy lifting here, she includes:
    • Asymmetric ciphers
    • Decoders
    • Digests
    • Encoders
    • Key derivation algorithms (KDF)
    • Key encapsulation methods (KEM)
    • Key exchange algorithms (KEX)
    • Key managers
    • Symmetric key managers
    • Message authentication code algorithms (MAC)
    • Random number generators (RNG, DRBG)
    • Signature algorithms
    • Store loaders
    • Symmetric ciphers
  • -commands — displays a list of standard commands.
  • -standard-commands — lists the standard commands. (yes bestie, similar energy, different flag 💅)
  • -digest-commands — 🚨 this option is deprecated. use digest-algorithms instead, fr fr. it displays a list of message digest commands, which are typically used as input to the openssl-dgst(1) or openssl-speed(1) commands.
  • -cipher-commands — 🚨 also deprecated, babe. use cipher-algorithms instead. it displays a list of cipher commands, which are typically used as input to the openssl-enc(1) or openssl-speed(1) commands.
  • -cipher-algorithms, -digest-algorithms, -kdf-algorithms, -mac-algorithms — display a list of symmetric cipher, digest, kdf and mac algorithms. peep "Display of algorithm names" below for how the names get shown. in verbose mode, the algorithms provided by a provider will get additional information on what parameters each implementation supports — that's the extra lore ✨
  • -random-instances — lists the primary, public and private random number generator details. all three flavors of randomness, serving looks.
  • -random-generators — displays a list of random number generators. see "Display of algorithm names" for how the names are displayed.
  • -encoders — displays a list of encoders. see "Display of algorithm names" for how the names are displayed. in verbose mode, the algorithms provided by a provider will get additional information on what parameters each implementation supports.
  • -decoders — displays a list of decoders. see "Display of algorithm names" for how the names are displayed. in verbose mode, the algorithms provided by a provider will get additional information on what parameters each implementation supports.
  • -public-key-algorithms — displays a list of public key algorithms, with each algorithm as a block of multiple lines, all but the first are indented. the options key-exchange-algorithms, kem-algorithms, signature-algorithms, and asymcipher-algorithms will display similar info — same format, different algorithm gossip.
  • -public-key-methods — displays a list of public key methods.
  • -key-managers — displays a list of key managers.
  • -skey-managers — displays a list of symmetric key managers.
  • -key-exchange-algorithms — displays a list of key exchange algorithms.
  • -kem-algorithms — displays a list of key encapsulation algorithms.
  • -tls-groups — displays a list of the IANA names of all available (implemented) TLS groups. by default the listed groups are those compatible with TLS 1.3. periodt.
  • -all-tls-groups — displays a list of the names of all available (implemented) TLS groups, including any aliases. some groups are known under multiple names, for example, secp256r1 is also known as P-256 — girlies with two names, love that for them. by default the listed groups are those compatible with TLS 1.3.
  • -tls1_2 — when listing TLS groups, list those compatible with TLS 1.2.
  • -tls1_3 — when listing TLS groups, output those compatible with TLS 1.3. TLS 1.3 is the current default protocol version, but heads up: the default version is subject to change, so best to specify the version explicitly. don't leave it to fate, bestie 💀
  • -signature-algorithms — displays a list of signature algorithms.
  • -tls-signature-algorithms — displays the list of signature algorithms available for TLS handshakes made available by all currently active providers. the output format is colon delimited in a form directly usable in SSL_CONF_cmd(3) specifying SignatureAlgorithms. copy-paste ready, we stan 🧚
  • -asymcipher-algorithms — displays a list of asymmetric cipher algorithms.
  • -store-loaders — displays a list of store loaders.
  • -providers — displays a list of all loaded providers with their names, version and status. in verbose mode, the full version and all provider parameters will additionally be displayed. the full tea, basically 🍓
  • -engines — 🚨 this option is deprecated. it displays a list of loaded engines. she's retired but still shows up to the party, we respect the legacy.
  • -disabled — displays a list of disabled features, those that were compiled out of the installation. the ones that didn't make the cut 😭
  • -objects — displays a list of built in objects, i.e. OIDs with names. they're listed in the format described in "ASN1 Object Configuration Module" in config(5).
  • -options command — outputs a two-column list of the options accepted by the specified command. the first is the option name, and the second is a one-character indication of what type of parameter it takes, if any. ⚠️ this is an internal option, used for checking that the documentation is complete. so like, dev business, you didn't hear it from me 🙈
  • -provider name
  • -provider-path path
  • -provparam [name:]key=value
  • -propquery propq — see "Provider Options" in openssl(1), provider(7), and property(7). all the provider lore lives over there.

🦋 Display of algorithm names 🦋

algorithm names may be displayed in one of two manners. two! a whole duality moment:

Legacy implementations ✨

legacy implementations will simply display the main name of the algorithm on a line of its own, or in the form "<foo " bar>> to show that "foo" is an alias for the main name, "bar".

Provided implementations 💜

implementations from a provider are displayed like this if the implementation is labeled with a single name:

 foo @ bar

or like this if it's labeled with multiple names:

 { foo1, foo2 } @bar

in both cases, "bar" is the name of the provider. the @ is literally the "who's your provider" tag, iykyk 🎀

🌈 HISTORY 🌈

  • the -engines, -digest-commands, and -cipher-commands options were deprecated in OpenSSL 3.0.
  • the -skey-managers option was added in OpenSSL 3.5. newcomer alert 🎉

Copyright 2016-2025 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, bestie 💅 this was 3.5.9, dated 2026-09-29 — go forth and openssl list responsibly, mwah 🫶🌸

📦 where this page comes from