CURLOPT_PROXY_SSL_CIPHER_LIST(3)

💅 CURLOPT_PROXY_SSL_CIPHER_LIST(3) 💅

okay so bestie, this one lives in the Library Functions Manual and it's all about telling curl which cipher suites to use when it's talking TLS to your HTTPS proxy. it's giving "let me pick my own outfit" energy, and honestly? iconic. 🎀

---

✨ NAME ✨

CURLOPT_PROXY_SSL_CIPHER_LIST — ciphers to use for HTTPS proxy

---

🌸 SYNOPSIS 🌸

#include <curl/curl.h>

CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_SSL_CIPHER_LIST,
                          char *list);

---

🦋 DESCRIPTION 🦋

so you pass a char pointer, mmkay? it points at a null-terminated string, and that string holds the list of cipher suites to use for the TLS 1.2 (1.1, 1.0) connection to the HTTPS proxy. lowkey important: the list must be syntactically correct — it's made of one or more cipher suite strings, separated by colons. colons are the vibe separator here, periodt. 💅

for setting TLS 1.3 ciphers, go look at CURLOPT_PROXY_TLS13_CIPHERS(3) instead — that's a whole different option, don't mix them up bestie 😭

a valid example of a cipher list, literally copy-this energy:

"ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:"
"ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305"

for Schannel, you can use this option to set algorithms but not specific cipher suites. refer to the ciphers lists document for algorithms. iykyk 🫶

find more details about cipher lists on this URL:

https://curl.se/docs/ssl-ciphers.html

also! the application does not have to keep the string around after setting this option. so you can yeet that buffer, it's fine, she's safe 🧚

using this option multiple times makes the last set string override the previous ones. set it to NULL to disable its use again — like taking the outfit off and going back to defaults, no cap. ✨

---

💖 DEFAULT 💖

NULL, use internal built-in list.

---

🌈 PROTOCOLS 🌈

this functionality affects all TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.

this option works only with the following TLS backends: OpenSSL, Rustls, Schannel, mbedTLS and wolfSSL 👑

---

🍓 EXAMPLE 🍓

int main(void)
{
  CURL *curl = curl_easy_init();
  if(curl) {
    CURLcode result;
    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
    curl_easy_setopt(curl, CURLOPT_PROXY, "https://localhost");
    curl_easy_setopt(curl, CURLOPT_PROXY_SSL_CIPHER_LIST,
                     "ECDHE-ECDSA-CHACHA20-POLY1305:"
                     "ECDHE-RSA-CHACHA20-POLY1305");
    result = curl_easy_perform(curl);
    curl_easy_cleanup(curl);
  }
}

---

⭐ HISTORY ⭐

• OpenSSL support added in 7.52.0.
• wolfSSL, Schannel support added in 7.87.0
• mbedTLS support added in 8.8.0.
• Rustls support added in 8.10.0.

since curl 8.10.0 returns CURLE_NOT_BUILT_IN when not supported. rude but fair 💀

---

🎀 AVAILABILITY 🎀

added in curl 7.52.0

---

🔥 RETURN VALUE 🔥

curl_easy_setopt(3) returns a CURLcode indicating success or error.

CURLE_OK (0) means everything was OK, non-zero means an error occurred — see libcurl-errors(3). 😭

---

👑 SEE ALSO 👑

• CURLOPT_PROXY_SSLVERSION(3)
• CURLOPT_PROXY_TLS13_CIPHERS(3)
• CURLOPT_SSLVERSION(3)
• CURLOPT_SSL_CIPHER_LIST(3)
• CURLOPT_TLS13_CIPHERS(3)

---

and that's the whole page bestie, ate and left no crumbs 🌸 this lil masterpiece is from libcurl, dated 2026-10-12, filed under CURLOPT_PR...CIPHER_LIST(3) — go forth and pick your ciphers 💜

mwah 💋