curl_global_sslset(3)

👑 curl_global_sslset(3) — Library Functions Manual

okay bestie, so this is a page from the Library Functions Manual, and it's literally about picking which SSL backend libcurl is gonna vibe with. it's giving "choose your fighter" but for TLS. let's get into it 💅

---

✨ NAME ✨

curl_global_sslset — select SSL backend to use

🦋 SYNOPSIS 🦋

#include <curl/curl.h>

CURLsslset curl_global_sslset(curl_sslbackend id,
                              const char *name,
                              const curl_ssl_backend ***avail);

💖 DESCRIPTION 💖

so this function configures at runtime which SSL backend to use with libcurl. no cap, it's the glow-up button for your TLS layer.

⚠️ major caveat: this function can only be used to select an SSL backend once, and it must be called before curl_global_init(3). so like, order matters, periodt.

the backend can be identified by the id (e.g. CURLSSLBACKEND_OPENSSL). you can also specify the backend via the name parameter for a case insensitive match — just pass CURLSSLBACKEND_NONE as the id and let the name do its thing. and if both id and name are specified? the name is ignored. sorry name, you're not the main character today 🙈

if neither id nor name are specified, the function fails with CURLSSLSET_UNKNOWN_BACKEND and sets the avail pointer to the NULL-terminated list of available backends. the available backends are those that this particular build of libcurl supports (so like, your build's specific roster 🎀).

since libcurl 7.60.0, the avail pointer is always set to the list of alternatives if non-NULL. always. constant. iconic.

upon success, the function returns CURLSSLSET_OK ✨.

if the specified SSL backend is not available, the function returns CURLSSLSET_UNKNOWN_BACKEND and sets the avail pointer to a NULL-terminated list of available SSL backends. and here's the nice part: in this case, you may call the function again to try to select a different backend. so it's not a one-and-done tragedy, you get a second chance 🫶

the SSL backend can be set only once. if it has already been set, a subsequent attempt to change it results in a CURLSSLSET_TOO_LATE getting returned. yeah, he's already taken, bestie 💀

this function is thread-safe since libcurl 7.84.0 if curl_version_info(3) has the CURL_VERSION_THREADSAFE feature bit set (most platforms).

if this is not thread-safe, you must not call this function when any other thread in the program (i.e. a thread sharing the same memory) is running. and that does not just mean no other thread that is using libcurl — read it again, it's strict, fr fr.

---

🌈 Names 🌈

SSL backend names, and they're case-insensitive: GnuTLS, mbedTLS, OpenSSL, Rustls, Schannel, wolfSSL

okay so this part is lowkey interesting: the name "OpenSSL" is used for all versions of OpenSSL and its associated forks/flavors in this function. OpenSSL, BoringSSL, LibreSSL, quictls and AmiSSL are all supported by libcurl, but in the eyes of curl_global_sslset(3) they are all just "OpenSSL". they all mostly provide the same API. if you want the tea on which one you're actually running, curl_version_info(3) can return more specific info about the exact OpenSSL flavor and version number in use 🔍

---

🧚 struct 🧚

typedef struct {
  curl_sslbackend id;
  const char *name;
} curl_ssl_backend;

typedef enum {
  CURLSSLBACKEND_NONE = 0,
  CURLSSLBACKEND_OPENSSL = 1, /* or one of its forks */
  CURLSSLBACKEND_GNUTLS = 2,
  CURLSSLBACKEND_NSS = 3,
  CURLSSLBACKEND_GSKIT = 5, /* deprecated */
  CURLSSLBACKEND_POLARSSL = 6, /* deprecated */
  CURLSSLBACKEND_WOLFSSL = 7,
  CURLSSLBACKEND_SCHANNEL = 8,
  CURLSSLBACKEND_SECURETRANSPORT = 9, /* deprecated */
  CURLSSLBACKEND_AXTLS = 10, /* deprecated */
  CURLSSLBACKEND_MBEDTLS = 11,
  CURLSSLBACKEND_MESALINK = 12, /* deprecated */
  CURLSSLBACKEND_BEARSSL = 13, /* deprecated */
  CURLSSLBACKEND_RUSTLS = 14
} curl_sslbackend;

---

⭐ PROTOCOLS ⭐

this functionality affects all supported protocols — every single one, no exclusions, we stan an equal-opportunity feature 🌸

🔥 EXAMPLE 🔥

int main(void)
{
  int i;
  /* choose a specific backend */
  curl_global_sslset(CURLSSLBACKEND_WOLFSSL, NULL, NULL);

  /* list the available ones */
  const curl_ssl_backend **list;
  curl_global_sslset(CURLSSLBACKEND_NONE, NULL, &list);

  for(i = 0; list[i]; i++)
    printf("SSL backend #%d: '%s' (ID: %d)\n",
           i, list[i]->name, list[i]->id);
}

first call picks wolfSSL, second call passes CURLSSLBACKEND_NONE with a &list so it hands you back the whole menu. then you just loop and print. chef's kiss 🎀

---

💜 AVAILABILITY 💜

Added in curl 7.56.0 — so like, vintage but not vintage vintage.

🍓 RETURN VALUE 🍓

• if this function returns CURLSSLSET_OK, the backend was successfully selected. slay 💅
• if the chosen backend is unknown (or support for the chosen backend has not been compiled into libcurl), the function returns CURLSSLSET_UNKNOWN_BACKEND.
• if the backend had been configured previously, or if curl_global_init(3) has already been called, the function returns CURLSSLSET_TOO_LATE.
• if this libcurl was built completely without SSL support, with no backends at all, this function returns CURLSSLSET_NO_BACKENDS. 😭 tragic, but at least it tells you.

---

🫶 SEE ALSO 🫶

• curl_global_init(3)
• libcurl(3)

---

go read those two next, bestie, they're the prerequisites of the prerequisites. iykyk ✨

that's the whole page! this one came from libcurl, dated 2026-10-12, and it's filed under curl_global_sslset(3). mwah, go forth and pick your backend 💖🦋✨