SSL_CTX_GET_VERIFY_MODE(3ossl)

✨ SSL_CTX_get_verify_mode ✨

okay bestie, so this is the OpenSSL 3ossl manual page for the little "getter" squad — the six functions that tell you what verification settings are currently in play. It's giving "peek behind the curtain, no cap." 💅

---

🌸 NAME 🌸

SSL_CTX_get_verify_mode, SSL_get_verify_mode, SSL_CTX_get_verify_depth, SSL_get_verify_depth, SSL_get_verify_callback, SSL_CTX_get_verify_callback — get currently set verification parameters 🫶

Literally a whole friend group of functions whose only job is to read back the verification settings you (or your defaults) already put there. They get. They don't set. Know the difference, iykyk. 🔥

---

🎀 SYNOPSIS 🎀

#include <openssl/ssl.h>

int SSL_CTX_get_verify_mode(const SSL_CTX *ctx);
int SSL_get_verify_mode(const SSL *ssl);
int SSL_CTX_get_verify_depth(const SSL_CTX *ctx);
int SSL_get_verify_depth(const SSL *ssl);
int (*SSL_CTX_get_verify_callback(const SSL_CTX *ctx))(int, X509_STORE_CTX *);
int (*SSL_get_verify_callback(const SSL *ssl))(int, X509_STORE_CTX *);

no cap, those last two are the ones that look like they were written by a cryptographer having a moment. They return a function pointer — the callback itself. So read them slow. 🐢

---

💖 DESCRIPTION 💖

okay so, six functions, and honestly the pattern is so clean it's iconic. Three of them want a const SSL_CTX *ctx (the whole context — the big picture), and three want a const SSL *ssl (one specific connection). Same questions, different scope. Slay. ✨

• SSL_CTX_get_verify_mode() — returns the verification mode currently set in ctx. 📋
• SSL_get_verify_mode() — returns the verification mode currently set in ssl. 📋
• SSL_CTX_get_verify_depth() — returns the verification depth limit currently set in ctx. Important caveat, bestie: if no limit has been explicitly set, it returns -1 and the default value will be used. So -1 is not a real depth, it's a "girl, I don't know, ask the default" situation. 😭
• SSL_get_verify_depth() — returns the verification depth limit currently set in ssl. Same deal: if no limit has been explicitly set, -1 is returned and the default value will be used. 🙈
• SSL_CTX_get_verify_callback() — returns a function pointer to the verification callback currently set in ctx. If no callback was explicitly set, the NULL pointer is returned and the default callback will be used. So NULL is lowkey a valid answer and means "the default's got it." 🧚
• SSL_get_verify_callback() — returns a function pointer to the verification callback currently set in ssl. If no callback was explicitly set, the NULL pointer is returned and the default callback will be used. Same energy, per-connection edition. 🦋

the pattern here is the main character: ctx versions for the shared context, ssl versions for the individual connection, and both of the "not set" cases fall back to defaults rather than failing. That's the whole vibe check of this page. 💜

---

🌈 RETURN VALUES 🌈

See DESCRIPTION. That's it. That's the section. The answers are all up there — modes, depth limits (or -1), and callback pointers (or NULL). Not me making you scroll back up, but like… scroll back up. 💀

---

⭐ SEE ALSO ⭐

• ssl(7)
• SSL_CTX_set_verify(3) — the setter, aka the one that actually does the thing these getters read back. Go there if you wanna change stuff instead of just peeking. 👑

---

👑 COPYRIGHT 👑

Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page, bestie 🫶💖 this was OpenSSL 3.5.6, dated 2026-04-07 — so go forth, read your verification params, and remember: -1 and NULL are answers, not errors. periodt. 💅🎀🌸