SSL_GET_CIPHERS(3)

💅 SSL_GET_CIPHERS — like, the whole girl-gang of SSL_CIPHERs

okay so this is a page from the Library Functions Manual, bestie, and it's all about getting your hands on lists of ciphers. plural. a whole stack of them. let's go 🎀

---

🌸 NAME 🌸

SSL_get_ciphers, SSL_CTX_get_ciphers, SSL_get1_supported_ciphers, SSL_get_client_ciphers, SSL_get_cipher_list — get lists of available SSL_CIPHERs.

like, all five of these functions are out here handing you ciphers. five besties, one mission. iykyk 💖

---

✨ SYNOPSIS ✨

first off, the library line, literally exactly as it appears:

library “libssl” libcrypto #include <openssl/ssl.h>

and then the functions themselves, no cap:

STACK_OF(SSL_CIPHER) *
SSL_get_ciphers(const SSL *ssl);

STACK_OF(SSL_CIPHER) *
SSL_CTX_get_ciphers(const SSL_CTX *ctx);

STACK_OF(SSL_CIPHER) *
SSL_get1_supported_ciphers(SSL *ssl);

STACK_OF(SSL_CIPHER) *
SSL_get_client_ciphers(const SSL *ssl);

const char *
SSL_get_cipher_list(const SSL *ssl, int priority);

---

🦋 DESCRIPTION 🦋

okay so let's take these one at a time because each one has its own vibe 🌈

• SSL_get_ciphers() — returns the stack of available SSL_CIPHERs for ssl, sorted by preference. the main character of the group, honestly.
• SSL_CTX_get_ciphers() — returns the stack of available SSL_CIPHERs for ctx. same energy, different object. 🫶
• SSL_get1_supported_ciphers() — returns a stack of enabled SSL_CIPHERs for ssl as it would be sent in a ClientHello, sorted by preference. and the list is lowkey a whole personality — it depends on settings like the cipher list, the supported protocol versions, the security level, and the enabled signature algorithms. also, the list of ciphers that would be sent in a ClientHello can differ from the list of ciphers that would be acceptable when acting as a server. for example, additional ciphers may be usable by a server if there's a gap in the list of supported protocols, and some ciphers may not be usable by a server if there isn't a suitable certificate configured. it's giving "context matters." 💅
• SSL_get_client_ciphers() — returns the stack of available SSL_CIPHERs matching the list received from the client on ssl. 💌

the details of the ciphers you get from SSL_get_ciphers(), SSL_CTX_get_ciphers(), SSL_get1_supported_ciphers(), and SSL_get_client_ciphers() can be obtained using the SSL_CIPHER_get_name(3) family of functions. yes, the whole family. iconic 👑

SSL_get_cipher_list() — okay, tea time 🍵 this one is deprecated (use SSL_get_ciphers() instead, bestie, please) and it's badly misnamed. like, the audacity. it does not return a list — it returns the name of one element of the return value of SSL_get_ciphers(), with the index given by the priority argument. passing 0 selects the cipher with the highest priority. to iterate over all available ciphers in decreasing priority, repeatedly increment the argument by 1 until NULL is returned. that's the whole loop. no, it's not a list, we've been over this 😭

---

🔥 RETURN VALUES 🔥

listen up, because the lifetime rules here are the drama 💀

• SSL_get_ciphers() returns an internal pointer to a list of ciphers, or NULL if ssl is NULL or if no ciphers are available. and here's the wild part — the returned pointer may not only become invalid when ssl is destroyed or when SSL_set_cipher_list(3) is called on it, but also when the SSL_CTX object in use by ssl at the time of the call is freed, or when SSL_CTX_set_cipher_list(3) is called on that context object. not me getting expired by an object i never even touched 🙈
• SSL_CTX_get_ciphers() returns an internal pointer to a list of ciphers, or NULL if ctx is NULL or if no ciphers are available. the returned pointer becomes invalid when ctx is destroyed or when SSL_CTX_set_cipher_list(3) is called on it. simple, clean, predictable. we love her ✨
• SSL_get1_supported_ciphers() returns a newly allocated list of ciphers, or NULL if ssl is NULL, if no ciphers are available, or if an error occurs. when the returned pointer is no longer needed, the caller is responsible for freeing it using sk_SSL_CIPHER_free(). yes that means you. don't leave her hanging, that's a memory leak 🌸
• SSL_get_client_ciphers() returns an internal pointer to a list of ciphers, or NULL if ssl is NULL, has no active session, or is not operating in server mode. the returned pointer becomes invalid when the SSL_SESSION object is destroyed — even if the ssl object remains valid. and it may also become invalid in other circumstances, for example when processing a new ClientHello. so like... handle with care 🎀
• SSL_get_cipher_list() returns an internal pointer to a string, or NULL if ssl is NULL, if no ciphers are available, or if priority is greater than or equal to the number of available ciphers. off the end of the array = nothing for you, bestie 💔

---

⭐ SEE ALSO ⭐

go read these too, fr fr:

• ssl(3)
• SSL_CIPHER_get_name(3)
• SSL_CTX_set_cipher_list(3)

---

👑 HISTORY 👑

storytime, bestie 📖

• SSL_get_cipher_list() first appeared in SSLeay 0.5.2.
• SSL_get_ciphers() first appeared in SSLeay 0.8.0.
• both functions have been available since OpenBSD 2.4. literal elders, we respect them 🫡
• SSL_CTX_get_ciphers() first appeared in OpenSSL 1.1.0 and has been available since OpenBSD 6.3.
• SSL_get1_supported_ciphers() and SSL_get_client_ciphers() first appeared in OpenSSL 1.1.0 and has been available since OpenBSD 6.5.

---

aaand that's the page!! 🌟 this one's from Debian, dated June 8, 2025 — so if you're reading this in a group chat years from now, that's where she came from. mwah, go free your ciphers responsibly 💜🎀🦋