CURLOPT_TLS13_CIPHERS(3)

💅 CURLOPT_TLS13_CIPHERS 💅

okay so bestie, welcome to the CURLOPT_TLS13_CIPHERS page from the Library Functions Manual — this is the whole vibe check on picking your TLS 1.3 cipher suites, and honestly? it's giving "small option, big energy" ✨

🌸 NAME 🌸

CURLOPT_TLS13_CIPHERS — the cipher suites to use for TLS 1.3, periodt 💅

✨ SYNOPSIS ✨

#include <curl/curl.h>

CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TLS13_CIPHERS, char *list);

🦋 DESCRIPTION 🦋

So you pass a char pointer, right? And that pointer points at a null-terminated string holding the list of cipher suites you wanna use for the TLS 1.3 connection. And like — the list must be syntactically correct, no cap. It's made of one or more cipher suite strings, separated by colons. That's the whole recipe 🎀

Now if you're trying to set TLS 1.2 (or 1.1, or 1.0) ciphers, that's a different girl — go see CURLOPT_SSL_CIPHER_LIST(3).

A valid example of a cipher list, bestie, looks like this:

"TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256"

Wanna find more details about cipher lists? It's literally right here on this URL:

https://curl.se/docs/ssl-ciphers.html

And the good news: the application does not have to keep the string around after setting this option. curl takes what it needs, you can let it go, we love a low-maintenance queen 🫶

Also — using this option multiple times makes the last set string override the previous ones. Set it to NULL to restore to internal default. Iconic, honestly.

🎀 DEFAULT 🎀

NULL, use internal built-in.

🌈 PROTOCOLS 🌈

This functionality affects all TLS based protocols: HTTPS, FTPS, IMAPS, POP3S, SMTPS etc. all of them, every last one 💖

This option works only with the following TLS backends: OpenSSL, Rustls, mbedTLS and wolfSSL.

⭐ EXAMPLE ⭐

int main(void)
{
  CURL *curl = curl_easy_init();
  if(curl) {
    CURLcode result;
    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
    curl_easy_setopt(curl, CURLOPT_TLS13_CIPHERS,
                     "TLS_CHACHA20_POLY1305_SHA256");
    result = curl_easy_perform(curl);
    curl_easy_cleanup(curl);
  }
}

look at her go 🧚

👑 HISTORY 👑

okay the lore is kind of long, so buckle up:

• OpenSSL support added in 7.61.0, available when built with OpenSSL >= 1.1.1.
• LibreSSL support added in 8.3.0, available when built with LibreSSL >= 3.4.1.
• wolfSSL support added in 8.10.0.
• mbedTLS support added in 8.10.0, available when built with mbedTLS >= 3.6.0.
• Rustls support added in 8.10.0.

And for the prequel era: before curl 8.10.0 with mbedTLS or wolfSSL, TLS 1.3 cipher suites were set by using the CURLOPT_SSL_CIPHER_LIST(3) option. different times, bestie 😭

🍓 AVAILABILITY 🍓

Added in curl 7.61.0.

💜 RETURN VALUE 💜

curl_easy_setopt(3) returns a CURLcode indicating success or error.

• CURLE_OK (0) means everything was OK — slay 💅
• non-zero means an error occurred — see libcurl-errors(3) for the tea.

🔥 SEE ALSO 🔥

• CURLOPT_PROXY_SSLVERSION(3)
• CURLOPT_PROXY_SSL_CIPHER_LIST(3)
• CURLOPT_PROXY_TLS13_CIPHERS(3)
• CURLOPT_SSLVERSION(3)
• CURLOPT_SSL_CIPHER_LIST(3)
• CURLOPT_USE_SSL(3)

---

that's the whole page bestie, go configure your ciphers and be iconic 🌸

libcurl · 2026-10-12 · CURLOPT_TLS13_CIPHERS(3) — mwah, ily, bye 🫶💖