SSL_SET_TMP_ECDH(3)

💖 SSL_SET_TMP_ECDH(3) 💖

okay so bestie, buckle up — this is the SSL_SET_TMP_ECDH(3) page from the library functions manual, and it's lowkey a history lesson in how we used to pick curves. it lives in libssl / libcrypto, and it's all about ECDH ephemeral key exchange ✨

---

🌸 NAME 🌸

SSL_set_tmp_ecdh, SSL_CTX_set_tmp_ecdh, SSL_set_ecdh_auto, SSL_CTX_set_ecdh_auto, SSL_set_tmp_ecdh_callback, SSL_CTX_set_tmp_ecdh_callback — pick a curve for ECDH ephemeral key exchange 🌀

---

🎀 SYNOPSIS 🎀

library “libssl” libcrypto #include <openssl/ssl.h>

long
SSL_set_tmp_ecdh(SSL *ssl, EC_KEY *ecdh);

long
SSL_CTX_set_tmp_ecdh(SSL_CTX *ctx, EC_KEY *ecdh);

long
SSL_set_ecdh_auto(SSL *ssl, int state);

long
SSL_CTX_set_ecdh_auto(SSL_CTX *ctx, int state);

void
SSL_set_tmp_ecdh_callback(SSL *ssl,
    EC_KEY *(*ecdh)(SSL *ssl, int is_export, int keylength));

void
SSL_CTX_set_tmp_ecdh_callback(SSL_CTX *ctx,
    EC_KEY *(*ecdh)(SSL *ssl, int is_export, int keylength));

---

🦋 DESCRIPTION 🦋

okay so the main character energy here is: in LibreSSL, automatic EC curve selection and generation is always enabled. like, it's just on. periodt. and apps cannot manually hand over EC keys for use with ECDH key exchange — that door is closed, bestie 🚪

the only thing SSL_set_tmp_ecdh() still does is this: the curve of the ecdh key you pass in becomes the only curve enabled for that ssl connection. that's it. so it's equivalent to calling SSL_set1_groups_list(3) with that same single curve name. same vibe, different function name 🫶

SSL_CTX_set_tmp_ecdh() does the exact same thing, but for all the connections that will be created from ctx in the future. future-proofing-ish, but not really 💅

and now the deprecated girlies:

• SSL_set_ecdh_auto()
• SSL_CTX_set_ecdh_auto()
• SSL_set_tmp_ecdh_callback()
• SSL_CTX_set_tmp_ecdh_callback()

these four are deprecated and have no effect. they're giving retired icon — they show up, they wave, they do nothing 💀

---

⭐ RETURN VALUES ⭐

• SSL_set_tmp_ecdh() and SSL_CTX_set_tmp_ecdh() return 1 on success or 0 on failure.
• SSL_set_ecdh_auto(), SSL_CTX_set_ecdh_auto(), SSL_set_tmp_ecdh_callback(), and SSL_CTX_set_tmp_ecdh_callback() always return 1. always. no cap. they literally cannot fail because they literally do nothing 😭

---

🌈 SEE ALSO 🌈

ssl(3), SSL_CTX_set1_groups(3), SSL_CTX_set_cipher_list(3), SSL_CTX_set_options(3), SSL_CTX_set_tmp_dh_callback(3), SSL_new(3) — go read these next, iykyk 📚

---

👑 HISTORY 👑

• SSL_set_tmp_ecdh(), SSL_CTX_set_tmp_ecdh(), SSL_set_tmp_ecdh_callback(), and SSL_CTX_set_tmp_ecdh_callback() first appeared in OpenSSL 0.9.8 and have been available since OpenBSD 4.5.
• SSL_CTX_set_ecdh_auto() and SSL_set_ecdh_auto() first appeared in OpenSSL 1.0.2 and have been available since OpenBSD 5.7.

---

alright bestie, that's the whole page, every last crumb of it 🍓 mwah 💋 this Debian edition is dated June 8, 2025, and it's the SSL_SET_TMP_ECDH(3) page — go forth and let the library pick your curves for you, because honestly it's gonna anyway 🌸💜