LIBRESSL-TLS_CONFIG_SET_PROTOCOLS(3)

💅 TLS_CONFIG_SET_PROTOCOLS(3) — like, the libtls protocol & cipher selection manual ✨

okay bestie, this one lives in the Library Functions Manual and it's all about libtls — the cozy little TLS wrapper. Buckle up, we're picking protocols and ciphers and it's gonna be iconic 🎀

---

🌸 NAME 🌸

tls_config_set_protocols, tls_config_parse_protocols, tls_config_set_alpn, tls_config_set_ciphers, tls_config_set_dheparams, tls_config_set_ecdhecurves, tls_config_prefer_ciphers_client, tls_config_prefer_ciphers_server — TLS protocol and cipher selection, aka the whole "which crypto vibes are we allowing" friend group 💖

---

✨ SYNOPSIS ✨

library “libtls” libssl libcrypto #include <tls.h>

int
tls_config_set_protocols(struct tls_config *config, uint32_t protocols);

int
tls_config_parse_protocols(uint32_t *protocols, const char *protostr);

int
tls_config_set_alpn(struct tls_config *config, const char *alpn);

int
tls_config_set_ciphers(struct tls_config *config, const char *ciphers);

int
tls_config_set_dheparams(struct tls_config *config, const char *params);

int
tls_config_set_ecdhecurves(struct tls_config *config,
    const char *curves);

void
tls_config_prefer_ciphers_client(struct tls_config *config);

void
tls_config_prefer_ciphers_server(struct tls_config *config);

---

🦋 DESCRIPTION 🦋

So these functions all do the same cute thing: they modify a configuration by setting parameters. And lowkey important — the configuration options apply to both clients and servers, unless noted otherwise. Equal opportunity config 💅

tls_config_set_protocols() — pick ur TLS eras 🕰️

This one specifies which versions of the TLS protocol may be used. The possible values are the bitwise OR of:

TLS_PROTOCOL_TLSv1_2
TLS_PROTOCOL_TLSv1_3

Plus, you can also use these values: TLS_PROTOCOL_TLSv1 (TLSv1.2, TLSv1.3), TLS_PROTOCOLS_ALL (all supported protocols) and TLS_PROTOCOLS_DEFAULT (TLSv1.2 and TLSv1.3). Obsessed with options fr 🫶

tls_config_parse_protocols() — the translator bestie 🔤

This utility function parses a protocol string and hands the corresponding value back to you via the protocols argument. Then you can pass that value straight into tls_config_set_protocols(). Teamwork 💖

The protocol string is a comma or colon separated list of keywords. The valid keywords are:

tlsv1.2
tlsv1.3
all      (all supported protocols)
default  (an alias for secure)
legacy   (an alias for all)
secure   (currently TLSv1.2 and TLSv1.3)

And here's the plot twist 🫢 — if a value has a negative prefix (in the form of a leading exclamation mark) then it is removed from the list of available protocols, rather than being added to it. It's giving subtraction, not addition, no cap.

tls_config_set_alpn() — the preference list 📋

This sets the ALPN protocols that are supported. The alpn string is a comma separated list of protocols, in order of preference. First place gets the crown 👑

tls_config_set_ciphers() — choose ur cipher squad 🔐

Sets the list of ciphers that may be used. Lists of ciphers are specified by name, and the permitted names are:

secure (or alias default)
compat
legacy
insecure (or alias all)

Alternatively — plot twist again — libssl cipher strings can be specified. Peep the CIPHERS section of openssl(1) for further information, iykyk 📖

tls_config_set_dheparams() — Diffie-Hellman Ephemeral settings 🌀

This specifies the parameters that will be used during Diffie-Hellman Ephemeral (DHE) key exchange. Possible values are:

none
auto
legacy

In auto mode, the key size for the ephemeral key is automatically selected based on the size of the private key being used for signing. In legacy mode, 1024 bit ephemeral keys are used. The default value is none, which disables DHE key exchange entirely. Periodt.

tls_config_set_ecdhecurves() — elliptic curve shopping spree 🌈

Specifies the names of the elliptic curves that may be used during Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) key exchange. This is a comma separated list, given in order of preference.

The special value of "default" will use the default curves (currently X25519MLKEM768, X25519, P-256 and P-384). Slay.

Heads up bestie 🫶 — this function replaces tls_config_set_ecdhecurve(), which is deprecated. Say bye to the old one 💀

tls_config_prefer_ciphers_client() — client's list wins 🧍‍♀️

Prefers ciphers in the client's cipher list when selecting a cipher suite (server only). This is considered to be less secure than preferring the server's list. So like, it's an option but maybe not the vibe 🌚

tls_config_prefer_ciphers_server() — server's list wins 🧍

Prefers ciphers in the server's cipher list when selecting a cipher suite (server only). This is considered to be more secure than preferring the client's list — and it's the default. Main character energy, honestly 🔥

---

💀 RETURN VALUES 💀

These functions return 0 on success or -1 on error. Short king behavior: zero means cute, negative one means something went wrong 😭

---

🎀 SEE ALSO 🎀

• tls_config_ocsp_require_stapling(3)
• tls_config_set_session_id(3)
• tls_config_verify(3)
• tls_init(3)
• tls_load_file(3)

Go read those next, they're all in the friend group 🫶

---

🌸 HISTORY 🌸

• tls_config_set_ciphers() appeared in OpenBSD 5.6 and got its final name in OpenBSD 5.7. Character development ✨
• tls_config_set_protocols(), tls_config_parse_protocols(), tls_config_set_dheparams(), and tls_config_set_ecdhecurve() appeared in OpenBSD 5.7.
• tls_config_prefer_ciphers_client() and tls_config_prefer_ciphers_server() showed up in OpenBSD 5.9.
• And tls_config_set_alpn() landed in OpenBSD 6.1.

A whole glow-up timeline, we love to see it 💖

---

👑 AUTHORS 👑

• Joel Sing <jsing@openbsd.org> — with contributions from
• Ted Unangst <tedu@openbsd.org> (for tls_config_set_ciphers())
• and Reyk Floeter <reyk@openbsd.org> (for tls_config_set_ecdhecurve())

Absolute icons, all three of them 🫶✨

---

that's the whole page bestie!! this one shipped from Debian on June 6, 2026, filed under TLS_CONFIG_SET_PROTOCOLS(3) — go forth and configure ur protocols responsibly 💅🎀