CURLOPT_PROXY_TLS13_CIPHERS(3)

💅 CURLOPT_PROXY_TLS13_CIPHERS(3) 💅

ok so this is a page from the Library Functions Manual and bestie, it's literally about picking which cipher suites your proxy TLS 1.3 connection gets to use. yes, we're going ✨ cryptographic ✨ today.

---

🎀 NAME 🎀

CURLOPT_PROXY_TLS13_CIPHERS — the cipher suites for your proxy's TLS 1.3 connection, no cap

---

🦋 SYNOPSIS 🦋

#include <curl/curl.h>

CURLcode curl_easy_setopt(CURL *handle, CURLOPT_PROXY_TLS13_CIPHERS,
                          char *list);

---

🌸 DESCRIPTION 🌸

okay so you're gonna pass a char pointer, and it points at a null-terminated string holding the list of cipher suites you wanna use for the TLS 1.3 connection to a proxy. the list has to be syntactically correct — like, it literally consists of one or more cipher suite strings separated by colons. that's the whole vibe check.

for setting TLS 1.2 (1.1, 1.0) ciphers, bestie, that's a different option: CURLOPT_PROXY_SSL_CIPHER_LIST(3) 🫶

a valid example of a cipher list is:

"TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256"

you can find more details about cipher lists at this URL:

https://curl.se/docs/ssl-ciphers.html

the application does not have to keep the string around after setting this option — so you can let it go, it's fine, it's free 💀

using this option multiple times makes the last set string override the previous ones. set it to NULL to disable its use again. iconic behavior honestly.

---

✨ DEFAULT ✨

NULL — which means use the internal built-in list

---

🌈 PROTOCOLS 🌈

this functionality affects all TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc.

this option works only with the following TLS backends: OpenSSL, Rustls, mbedTLS and wolfSSL 👑

---

💖 EXAMPLE 💖

int main(void)
{
  CURL *curl = curl_easy_init();
  if(curl) {
    CURLcode result;
    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
    curl_easy_setopt(curl, CURLOPT_PROXY_TLS13_CIPHERS,
                     "TLS_CHACHA20_POLY1305_SHA256");
    result = curl_easy_perform(curl);
    curl_easy_cleanup(curl);
  }
}

---

🧚 HISTORY 🧚

• OpenSSL support added in 7.61.0, available when built with OpenSSL >= 1.1.1.
• LibreSSL support added in 8.3.0, available when built with LibreSSL >= 3.4.1.
• wolfSSL support added in 8.10.0.
• mbedTLS support added in 8.10.0, available when built with mbedTLS >= 3.6.0.
• Rustls support added in 8.10.0.

before curl 8.10.0, with mbedTLS or wolfSSL, TLS 1.3 cipher suites were set by using the CURLOPT_PROXY_SSL_CIPHER_LIST(3) option. so like, keep that in mind if you're time-traveling 🕰️

---

⭐ AVAILABILITY ⭐

added in curl 7.61.0

---

🍓 RETURN VALUE 🍓

curl_easy_setopt(3) returns a CURLcode indicating success or error.

CURLE_OK (0) means everything was OK 😌. non-zero means an error occurred — see libcurl-errors(3) 😭

---

🔥 SEE ALSO 🔥

• CURLOPT_PROXY_SSLVERSION(3)
• CURLOPT_PROXY_SSL_CIPHER_LIST(3)
• CURLOPT_SSLVERSION(3)
• CURLOPT_SSL_CIPHER_LIST(3)
• CURLOPT_TLS13_CIPHERS(3)

---

💜 and that's the whole page bestie, go forth and cipher responsibly

ok bye ily! this was libcurl, dated 2026-10-12 — mwah 💋 🎀