SSL_CTX_SET1...MP_PREFERENCE(3ossl)

💅 SSL_CTX_set1_cert_comp_preference, SSL_set1_cert_comp_preference, SSL_CTX_compress_certs, SSL_compress_certs, SSL_CTX_get1_compressed_cert, SSL_get1_compressed_cert, SSL_CTX_set1_compressed_cert, SSL_set1_compressed_cert — Certificate compression functions

okay so this is the 3ossl page for the OpenSSL certificate compression girlies 🎀 — literally every function on this page is about squishing certs down before you send them. no cap, it's a whole vibe.

✨ NAME ✨

SSL_CTX_set1_cert_comp_preference, SSL_set1_cert_comp_preference, SSL_CTX_compress_certs, SSL_compress_certs, SSL_CTX_get1_compressed_cert, SSL_get1_compressed_cert, SSL_CTX_set1_compressed_cert, SSL_set1_compressed_cert — certificate compression functions. that's the whole main character lineup 💖

🌸 SYNOPSIS 🌸

#include <openssl/ssl.h>

int SSL_CTX_set1_cert_comp_preference(SSL_CTX *ctx, int *algs, size_t len);
int SSL_set1_cert_comp_preference(SSL *ssl, int *algs, size_t len);

int SSL_CTX_compress_certs(SSL_CTX *ctx, int alg);
int SSL_compress_certs(SSL *ssl, int alg);

size_t SSL_CTX_get1_compressed_cert(SSL_CTX *ctx, int alg, unsigned char **data,
                                    size_t *orig_len);
size_t SSL_get1_compressed_cert(SSL *ssl, int alg, unsigned char **data,
                                size_t *orig_len);

int SSL_CTX_set1_compressed_cert(SSL_CTX *ctx, int alg,
                                 unsigned char *comp_data,
                                 size_t comp_length, size_t orig_length);
int SSL_set1_compressed_cert(SSL *ssl, int alg, unsigned char *comp_data,
                             size_t comp_length, size_t orig_length);

🦋 DESCRIPTION 🦋

so these functions control the certificate compression feature, and the one thing you have to know before anything else: certificate compression is only available for TLSv1.3, as defined in RFC8879. periodt. no TLSv1.2 crumbs 💀

setting your preference order 👑

SSL_CTX_set1_cert_comp_preference() and SSL_set1_cert_comp_preference() are how you specify your preferred compression algorithms. the algs argument is an array of algorithms, and length is the number of elements in the algs array. only those algorithms enabled in the library will be accepted in algs — and unknown algorithms in algs are just ignored, they get no attention bestie 🙈. on an error, the preference order is left unmodified, which is honestly very considerate of it.

the following compression algorithms (the alg arguments) may be used:

• TLSEXT_comp_cert_brotli
• TLSEXT_comp_cert_zlib
• TLSEXT_comp_cert_zstd

that list up there? that is also the default preference order, iconic behavior 💅. if a preference order is not specified, then the default preference order is sent to the peer and the received peer's preference order will be used when compressing a certificate. otherwise, the configured preference order is sent to the peer and is used to filter the peer's preference order.

pre-compressing your certs 🗜️

SSL_CTX_compress_certs() and SSL_compress_certs() are used to pre-compress all the configured certificates on an SSL_CTX/SSL object with algorithm alg. if alg is 0, then the certificates are compressed with the algorithms specified in the preference list. calling these functions on a client SSL_CTX/SSL object will result in an error, because only server certificates may be pre-compressed. sorry client girlies, this one's not for you 😭

getting that compressed cert back 🎁

SSL_CTX_get1_compressed_cert() and SSL_get1_compressed_cert() are used to get the pre-compressed certificate most recently set that may be stored for later use. calling these on a client SSL_CTX/SSL object will result in an error too — again, only server certificates may be pre-compressed. the data and orig_len arguments are required, like non-negotiable 🫶

feeding one back in 🍓

the compressed certificate data may be passed to SSL_CTX_set1_compressed_cert() or SSL_set1_compressed_cert() to provide a pre-compressed version of the most recently set certificate. this pre-compressed certificate can only be used by a server.

🌈 NOTES 🌈

each side of the connection sends their compression algorithm preference list to their peer, indicating compressed certificate support. the received preference list is filtered by the configured preference list (i.e. the intersection is saved — math ate that 💀). since the default list includes all the enabled algorithms, not specifying a preference will allow any enabled algorithm by the peer. the filtered peer's preference order is used to determine what algorithm to use when sending a compressed certificate.

only server certificates may be pre-compressed. calling any of these functions (except SSL_CTX_set1_cert_comp_preference()/SSL_set1_cert_comp_preference()) on a client SSL_CTX/SSL object will return an error. client certificates are compressed on-demand, as unique context data from the server is compressed along with the certificate. lowkey a different whole workflow bestie ✨

for SSL_CTX_set1_cert_comp_preference() and SSL_set1_cert_comp_preference() the len argument is the size of the algs argument in bytes.

the compressed certificate returned by SSL_CTX_get1_compressed_cert() and SSL_get1_compressed_cert() is the last certificate set on the SSL_CTX/SSL object. the certificate is copied by the function and the caller must free *data via OPENSSL_free(). do not skip that step, it's giving memory leak energy and we don't do that here 🙅‍♀️

the compressed certificate data set by SSL_CTX_set1_compressed_cert() and SSL_set1_compressed_cert() is copied into the SSL_CTX/SSL object. it's a copy, you're safe, breathe 🧚

SSL_CTX_compress_certs() and SSL_compress_certs() return an error under the following conditions:

• if no certificates have been configured.
• if the specified algorithm alg is not enabled.
• if alg is 0 and no compression algorithms are enabled.

heads up queen 👑 — sending compressed certificates may be disabled on a connection via the SSL_OP_NO_TX_CERTIFICATE_COMPRESSION option. receiving compressed certificates may be disabled on a connection via the SSL_OP_NO_RX_CERTIFICATE_COMPRESSION option. that's your on/off switch for each direction, don't forget it exists.

💜 RETURN VALUES 💜

SSL_CTX_set1_cert_comp_preference(), SSL_set1_cert_comp_preference(), SSL_CTX_compress_certs(), SSL_compress_certs(), SSL_CTX_set1_compressed_cert(), and SSL_set1_compressed_cert() return 1 for success and 0 on error. classic yes/no behavior, no surprises 💖

SSL_CTX_get1_compressed_cert() and SSL_get1_compressed_cert() return the length of the allocated memory on success and 0 on error. so like, 0 always means "nope", whether you're checking a size_t or an int — remember that 🫶

🔥 SEE ALSO 🔥

• SSL_CTX_set_options(3)
• SSL_CTX_use_certificate(3)

go read those next, iykyk 📚

⭐ HISTORY ⭐

these functions were added in OpenSSL 3.2. so if you're on something older, sorry babe, no compressed certs for you 😭

🎀 COPYRIGHT 🎀

Copyright 2022 The OpenSSL Project Authors. All Rights Reserved.

licensed under the Apache License 2.0 (the "License"). you may not use this file except in compliance with the License. you can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page bestie, you ate that 🍓✨ this was version 3.5.6, dated 2026-04-0, straight from the OpenSSL manual — go compress something, slay 💅💖