SSL_CTX_SET_CERT_CB(3ossl)

📦
version 15.1 · 3 versions
, in freebsd 15.1

💅 SSL_CTX_SET_CERT_CB(3ossl) — like, the cert callback era

okay bestie, so this is an OpenSSL manual page, 3ossl section, and it's all about the certificate callback function. yes, the cert callback. it's giving "let me handle certs myself" energy and honestly? iconic. 🎀

✨ NAME ✨

SSL_CTX_set_cert_cb, SSL_set_cert_cb — handle certificate callback function

🌸 SYNOPSIS 🌸

#include <openssl/ssl.h>

void SSL_CTX_set_cert_cb(SSL_CTX *c, int (*cert_cb)(SSL *ssl, void *arg),
                         void *arg);
void SSL_set_cert_cb(SSL *s, int (*cert_cb)(SSL *ssl, void *arg), void *arg);

💖 DESCRIPTION 💖

so SSL_CTX_set_cert_cb() and SSL_set_cert_cb() set the cert_cb callback, and arg is a pointer that gets passed straight through to your application callback. 🫶

when cert_cb is NULL, no callback function is used. that's it, that's the whole vibe check. ✨

now the main character: cert_cb is the application defined callback. it gets called before a certificate will be used by a client or server. so the callback can peek at the passed ssl structure and set or clear any appropriate certificates. literally the perfect moment to do it. 🔥

okay but here's the part you cannot skip:

  • if the callback is successful it MUST return 1 — even if no certificates have been set. yes, even then. no cap.
  • a zero is returned on error, which will abort the handshake with a fatal internal error alert. 💀
  • a negative return value will suspend the handshake and the handshake function will return immediately. then SSL_get_error(3) will return SSL_ERROR_WANT_X509_LOOKUP to indicate that the handshake was suspended. 🦋
  • the next call to the handshake function will again lead to the call of cert_cb. so it's the job of the cert_cb to store information about the state of the last call, if it's required to continue. iykyk — keep your receipts. 🧚

👑 NOTES 👑

an application will typically call SSL_use_certificate() and SSL_use_PrivateKey() to set the end entity certificate and private key. it can add intermediate and optionally the root CA certificates using SSL_add1_chain_cert(). slay, full chain. 💅

it might also call SSL_certs_clear() to delete any certificates associated with the SSL object. sometimes you just gotta clear the timeline. 🙈

the certificate callback functionality supersedes the (largely broken) functionality provided by the old client certificate callback interface. yes bestie, we said largely broken. it's always called even if a certificate is already set, so the callback can modify or delete the existing certificate. always. called. 🔥

a more advanced callback might examine the handshake parameters and set whatever chain is appropriate. for example: a legacy client supporting only TLSv1.0 might receive a certificate chain signed using SHA1, whereas a TLSv1.2 or later client which advertises support for SHA256 could receive a chain using SHA256. different chain for different vibes, honestly. 🌈

normal server sanity checks are performed on any certificates set by the callback. so if an EC chain is set for a curve the client does not support, it will not be used. the server checks your fit before it wears it. 💅✨

⭐ RETURN VALUES ⭐

SSL_CTX_set_cert_cb() and SSL_set_cert_cb() do not return values. nothing to check, nothing to obsess over. 🎀

🦋 SEE ALSO 🦋

Copyright 2014-2020 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at https://www.openssl.org/source/license.html.

ngl bestie, read the license. it's the law, and also it's giving responsible queen behavior. 👑

okay that's the whole page!! this one's from OpenSSL 3.5.6, dated 2026-04-07, and the manual page is SSL_CTX_SET_CERT_CB(3ossl) — mwah, go set some certs. 💖✨🎀🫶

📦 where this page comes from