LIBRESSL-SSL_CTX_SET_MIN_PROTO_VERSION(3)

💅 SSL_CTX_SET_MIN_PROTO_VERSION(3) — like, the whole proto-version situation

okay bestie, welcome to the Library Functions Manual corner of the universe, where we deal with exactly one (1) extremely specific thing: telling your TLS stack which protocol versions are allowed to party and which ones need to go home. 🎀

---

✨ NAME ✨

SSL_CTX_set_min_proto_version, SSL_CTX_set_max_proto_version, SSL_CTX_get_min_proto_version, SSL_CTX_get_max_proto_version, SSL_set_min_proto_version, SSL_set_max_proto_version, SSL_get_min_proto_version, SSL_get_max_proto_version — the getters and setters for the minimum and maximum supported protocol version. that's it, that's the whole gig. 🦋

---

🌸 SYNOPSIS 🌸

library “libssl” libcrypto #include <openssl/ssl.h>

int
SSL_CTX_set_min_proto_version(SSL_CTX *ctx, uint16_t version);

int
SSL_CTX_set_max_proto_version(SSL_CTX *ctx, uint16_t version);

int
SSL_CTX_get_min_proto_version(SSL_CTX *ctx);

int
SSL_CTX_get_max_proto_version(SSL_CTX *ctx);

int
SSL_set_min_proto_version(SSL *ssl, uint16_t version);

int
SSL_set_max_proto_version(SSL *ssl, uint16_t version);

int
SSL_get_min_proto_version(SSL *ssl);

int
SSL_get_max_proto_version(SSL *ssl);

like, eight functions, all iconically named, all doing exactly what they say on the tin. 👑

---

💖 DESCRIPTION 💖

so these functions get or set the minimum and maximum supported protocol versions for ctx or ssl. cute, right? the way it works: this plays nice in combination with the options you set via SSL_CTX_set_options(3), which also make it possible to disable specific protocol versions. but bestie, listen to me — use these functions instead of disabling specific protocol versions. that's the whole vibe. use these ones, not the other thing. iykyk. 💅

setting the minimum or maximum version to 0 will enable protocol versions down to the lowest, or up to the highest version supported by the library — respectively. so 0 is basically the "no thoughts, head empty, give me everything" setting. 🌈

currently supported versions are TLS1_VERSION, TLS1_1_VERSION, and TLS1_2_VERSION for TLS, and DTLS1_VERSION and DTLS1_2_VERSION for DTLS. those are the ones on the guest list, fr fr. 🎟️

in other implementations these functions may be implemented as macros. so like, don't be shocked if the vibe is slightly different over there. 🙈

---

🔥 RETURN VALUES 🔥

the setter functions return 1 on success or 0 on failure. slay or don't slay, there is no in-between. ✨

the getter functions return the configured version, or 0 if ctx or ssl has been configured to automatically use the lowest or highest version supported by the library. so 0 again means "we're just going with the flow." 🌸

---

🫶 SEE ALSO 🫶

ssl(3), SSL_CTX_new(3), SSL_CTX_set_options(3)

go read those too, bestie, they're literally right there. 📚

---

👑 HISTORY 👑

okay the lore here is genuinely iconic. the setter functions first appeared in BoringSSL in December 2014, with shorter names without the proto_ part. then, two years later, OpenSSL included them in their 1.1.0 release — gratuitously changing the names. Google shrugged and adopted the longer names one month later. 💀 and they've been available since OpenBSD 6.2.

the getter functions first appeared in OpenSSL 1.1.0g and have been available since OpenBSD 6.3. the way that the getters showed up later than the setters... main character energy tbh. 🌟

---

lowkey this whole page is the story of "just set a min and a max, babe." don't overthink it. 🍓

and that's the tea. this page came from Debian, dated June 8, 2025, filed under SSL_CTX_SET_MIN_PROTO_VERSION(3) — mwah, periodt. 💋🎀