CURLOPT_SSL_CIPHER_LIST(3)

💅 NAME 💅

hey bestie 🫶 you're looking at CURLOPT_SSL_CIPHER_LIST(3) from the Library Functions Manual, and she's all about CURLOPT_SSL_CIPHER_LIST — the ciphers to use for TLS. no cap, this one's giving secure-connection main character energy ✨

---

✨ SYNOPSIS ✨

#include <curl/curl.h>

CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_CIPHER_LIST, char *list);

---

🎀 DESCRIPTION 🎀

okay so you pass a char pointer, pointing to a null-terminated string holding the list of cipher suites to use for the TLS 1.2 (1.1, 1.0) connection. the list has to be syntactically correct, periodt — it consists of one or more cipher suite strings separated by colons 🫶

for setting TLS 1.3 ciphers, see CURLOPT_TLS13_CIPHERS(3) 💅

a valid example of a cipher list with OpenSSL is:

"ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:"
"ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305"

for Schannel, you can use this option to set algorithms but not specific cipher suites. refer to the ciphers lists document for algorithms 👑

GnuTLS has the concept of a priority string which has its own syntax and keywords. the string set via CURLOPT_SSL_CIPHER_LIST(3) directly influences the priority setting. the priority string doc lives here: https://gnutls.org/manual/html_node/Priority-Strings.html 🌸

find more details about cipher lists on this URL:

https://curl.se/docs/ssl-ciphers.html

the application does not have to keep the string around after setting this option — so let that string go, bestie, it's fine 💖

using this option multiple times makes the last set string override the previous ones. set it to NULL to disable its use again 🦋

---

🦋 DEFAULT 🦋

NULL, use built-in list 🎀

---

🌸 PROTOCOLS 🌸

this functionality affects all TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc. ✨

this option works only with the following TLS backends: GnuTLS, OpenSSL, Rustls, Schannel, mbedTLS and wolfSSL 💅

---

💅 EXAMPLE 💅

int main(void)
{
  CURL *curl = curl_easy_init();
  if(curl) {
    CURLcode result;
    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
    curl_easy_setopt(curl, CURLOPT_SSL_CIPHER_LIST,
                     "ECDHE-ECDSA-CHACHA20-POLY1305:"
                     "ECDHE-RSA-CHACHA20-POLY1305");
    result = curl_easy_perform(curl);
    curl_easy_cleanup(curl);
  }
}

---

🧚 HISTORY 🧚

• OpenSSL support added in 7.9.
• wolfSSL support added in 7.53.0.
• Schannel support added in 7.61.0.
• mbedTLS support added in 8.8.0.
• Rustls support added in 8.10.0.

🚨 since curl 8.10.0 returns CURLE_NOT_BUILT_IN when not supported. that's the vibe check, bestie 💀

---

⭐ AVAILABILITY ⭐

added in curl 7.9 🫶

---

🔥 RETURN VALUE 🔥

curl_easy_setopt(3) returns a CURLcode indicating success or error. ✨

CURLE_OK (0) means everything was OK, non-zero means an error occurred, see libcurl-errors(3) 💖

---

👑 SEE ALSO 👑

• CURLOPT_PROXY_SSL_CIPHER_LIST(3)
• CURLOPT_PROXY_TLS13_CIPHERS(3)
• CURLOPT_SSLVERSION(3)
• CURLOPT_TLS13_CIPHERS(3)
• CURLOPT_USE_SSL(3)

---

mwah 💖 source: libcurl, date: 2026-10-12, page: CURLOPT_SSL_CIPHER_LIST(3) — she ate and left no crumbs 🎀