SSL_CIPHER_GET_NAME(3ossl)

📦
version 15.1 · 2 versions
, in freebsd 15.1

💅 SSL_CIPHER_GET_NAME — get SSL_CIPHER properties

okay so this is the 3ossl manual page, and it's literally the group chat for every function that tells you stuff about an SSL_CIPHER — its name, its bits, its version, its NIDs, all of it. bestie, get comfy, there's like fifteen functions here and every single one is a baddie in her own way 🎀

✨ SYNOPSIS ✨

#include <openssl/ssl.h>

const char *SSL_CIPHER_get_name(const SSL_CIPHER *cipher);
const char *SSL_CIPHER_standard_name(const SSL_CIPHER *cipher);
const char *OPENSSL_cipher_name(const char *stdname);
int SSL_CIPHER_get_bits(const SSL_CIPHER *cipher, int *alg_bits);
const char *SSL_CIPHER_get_version(const SSL_CIPHER *cipher);
char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int size);
int SSL_CIPHER_get_cipher_nid(const SSL_CIPHER *c);
int SSL_CIPHER_get_digest_nid(const SSL_CIPHER *c);
const EVP_MD *SSL_CIPHER_get_handshake_digest(const SSL_CIPHER *c);
int SSL_CIPHER_get_kx_nid(const SSL_CIPHER *c);
int SSL_CIPHER_get_auth_nid(const SSL_CIPHER *c);
int SSL_CIPHER_is_aead(const SSL_CIPHER *c);
const SSL_CIPHER *SSL_CIPHER_find(SSL *ssl, const unsigned char *ptr);
uint32_t SSL_CIPHER_get_id(const SSL_CIPHER *c);
uint16_t SSL_CIPHER_get_protocol_id(const SSL_CIPHER *c);

🌸 DESCRIPTION 🌸

okay, going one by one, no skips, we're doing the whole roster 💖

SSL_CIPHER_get_name() — hands you back a pointer to the name of cipher. and if cipher is NULL? you get "(NONE)". that's it, that's the whole vibe. 🫶

SSL_CIPHER_standard_name() — same deal but it's the standard RFC name of cipher. NULL cipher → "(NONE)". but if the cipher genuinely has no standard name, it returns NULL (not the same thing, bestie, don't mix them up 💀). also, if the cipher was defined in both SSLv3 and TLS, you get the TLS name. slay.

OPENSSL_cipher_name() — the reverse direction, glow-up edition ✨: give it stdname and it hands back the OpenSSL name. if stdname is NULL, or stdname just has no corresponding OpenSSL name, you get "(NONE)". and where both exist, stdname should be the TLS name rather than the SSLv3 name. iykyk.

SSL_CIPHER_get_bits() — the number of secret bits used for cipher. cipher is NULL → 0. that's the whole function, she's short and she's iconic.

SSL_CIPHER_get_version() — returns a string indicating the SSL/TLS protocol version that first defined the cipher. cipher is NULL → "(NONE)". 🦋

SSL_CIPHER_get_cipher_nid() — the cipher NID for c. but if there's no cipher (think: cipher suites with no encryption), you get NID_undef. not me getting a whole NID for nothing 🙈

SSL_CIPHER_get_digest_nid() — the digest NID for the MAC that c uses during record encryption/decryption. no digest (like, for AEAD cipher suites)? NID_undef. periodt.

SSL_CIPHER_get_handshake_digest() — returns an EVP_MD for the digest used during the SSL/TLS handshake when using the SSL_CIPHER c. ⚠️ heads up though: this may be different from the digest used to calculate the MAC for encrypted records. main character digest ≠ side character digest, got it.

SSL_CIPHER_get_kx_nid() — the key exchange NID for the method c uses. no key exchange → NID_undef. but if any appropriate key exchange algorithm can be used (as with TLS 1.3 cipher suites), you get NID_kx_any. examples (not comprehensive, so don't come for me):

NID_kx_rsa
NID_kx_ecdhe
NID_kx_dhe
NID_kx_psk

SSL_CIPHER_get_auth_nid() — the authentication NID for the method c uses. no authentication → NID_undef. if any appropriate authentication algorithm can be used (again, TLS 1.3 cipher suites, she's flexible 💅) → NID_auth_any. examples (not comprehensive):

NID_auth_rsa
NID_auth_ecdsa
NID_auth_psk

SSL_CIPHER_is_aead() — 1 if cipher c is AEAD (like GCM or ChaCha20/Poly1305), 0 if it's not. binary queen. 👑

SSL_CIPHER_find() — returns an SSL_CIPHER structure whose cipher ID is stored in ptr. the ptr param is a two element array of char holding the two-byte TLS cipher ID (as allocated by IANA) in network byte order. usually you grab this from a TLS packet using functions like SSL_client_hello_get0_ciphers(3). returns NULL if an error occurs or the indicated cipher is not found. 🔥

SSL_CIPHER_get_id() — the OpenSSL-specific ID of cipher c. and ngl, that ID is not the same as the IANA-specific ID. do not confuse them, i'm begging 😭

SSL_CIPHER_get_protocol_id() — the two-byte ID used in the TLS protocol for cipher c. that's the other one, the one that matches the wire.

SSL_CIPHER_description() — returns a textual description of the cipher used, into the buffer buf of length len provided. if buf is provided, it must be at least 128 bytes. if buf is NULL it'll be allocated using OPENSSL_malloc(). and if the provided buffer is too small, or the allocation fails — NULL. no mercy. 💀

🧚 the description string, field by field

the string from SSL_CIPHER_description() is several fields separated by whitespace, and here's the whole lineup:

  • <ciphername> — textual representation of the cipher name.
  • <protocol version> — the minimum protocol version that the ciphersuite supports, like TLSv1.2. ⚠️ note that this isn't always the same as the protocol version in which the ciphersuite was first defined, because some ciphersuites are backwards compatible with earlier protocol versions. the way this trips people up… 😭
  • Kx=<key exchange> — key exchange method such as RSA, ECDHE, etc.
  • Au=<authentication> — authentication method such as RSA, None, etc.. None is the representation of anonymous ciphers.
  • Enc=<symmetric encryption method> — encryption method, with number of secret bits, such as AESGCM(128).
  • Mac=<message authentication code> — message digest, such as SHA256.

🌈 some examples for the output of SSL_CIPHER_description()

ECDHE-RSA-AES256-GCM-SHA256 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(256) Mac=AEAD
RSA-PSK-AES256-CBC-SHA384 TLSv1.0 Kx=RSAPSK   Au=RSA  Enc=AES(256)  Mac=SHA384

look at those aligned columns, she ate and left absolutely no crumbs 🍓

⭐ RETURN VALUES ⭐

  • SSL_CIPHER_get_name(), SSL_CIPHER_standard_name(), OPENSSL_cipher_name(), SSL_CIPHER_get_version() and SSL_CIPHER_description() — return the corresponding value in a NUL-terminated string for a specific cipher, or "(NONE)" if the cipher is not found.
  • SSL_CIPHER_get_bits() — a positive integer representing the number of secret bits, or 0 if an error occurred.
  • SSL_CIPHER_get_cipher_nid(), SSL_CIPHER_get_digest_nid(), SSL_CIPHER_get_kx_nid() and SSL_CIPHER_get_auth_nid() — the NID value, or NID_undef if an error occurred.
  • SSL_CIPHER_get_handshake_digest() — a valid EVP_MD structure, or NULL if an error occurred.
  • SSL_CIPHER_is_aead() — 1 if the cipher is AEAD, 0 otherwise.
  • SSL_CIPHER_find() — a valid SSL_CIPHER structure, or NULL if an error occurred.
  • SSL_CIPHER_get_id() — a 4-byte integer representing the OpenSSL-specific ID.
  • SSL_CIPHER_get_protocol_id() — a 2-byte integer representing the TLS protocol-specific ID.

🦋 SEE ALSO 🦋

ssl(7), SSL_get_current_cipher(3), SSL_get_ciphers(3), openssl-ciphers(1)

💜 HISTORY 💜

the lore, bestie, keep up:

  • SSL_CIPHER_get_version() was updated to always return the correct protocol string in OpenSSL 1.1.0.
  • SSL_CIPHER_description() was changed to return NULL on error, rather than a fixed string, in OpenSSL 1.1.0. (yes she used to return a whole fixed string on error, we don't talk about it 😭)
  • SSL_CIPHER_get_handshake_digest() was added in OpenSSL 1.1.1.
  • SSL_CIPHER_standard_name() was globally available in OpenSSL 1.1.1. before that, tracing (the enable-ssl-trace argument to Configure) was required to enable this function. yeah. you had to enable it. wild.
  • OPENSSL_cipher_name() was added in OpenSSL 1.1.1.

Copyright 2000-2025 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page, you're officially educated ✨ mwah 💋 — this was OpenSSL 3.5.6, dated 2026-04-07, signing off from the SSL_CIPHER_GET_NAME(3ossl) manual. go read ssl(7) next, i believe in you 🫶🌈

📦 where this page comes from