SSL_CTX_SET_SSL_VERSION(3ossl)

📦 version 3.5.0, in opensuse-leap 16.0

💅 SSL_CTX_SET_SSL_VERSION(3ossl) — like, the whole choose-a-new-TLS/SSL-method situation

okay so bestie, welcome to the OpenSSL party 🎀 this page lives in the 3ossl manual section, and it's all about swapping out which TLS/SSL method an object is vibing with. four functions, one glow-up, let's go ✨

🌸 NAME 🌸

SSL_CTX_set_ssl_version, SSL_CTX_get_ssl_method, SSL_set_ssl_method, SSL_get_ssl_method — choose a new TLS/SSL method 🦋

✨ SYNOPSIS ✨

#include <openssl/ssl.h>

int SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *method);
const SSL_METHOD *SSL_CTX_get_ssl_method(const SSL_CTX *ctx);

int SSL_set_ssl_method(SSL *s, const SSL_METHOD *method);
const SSL_METHOD *SSL_get_ssl_method(const SSL *ssl);

like, that's it. that's the whole squad 💅

💖 DESCRIPTION 💖

SSL_CTX_set_ssl_version() sets a brand-new default TLS/SSL method for the SSL objects that get newly created from this ctx. and the way that it works is so specific: most of the configuration attached to the SSL_CTX object is retained, with the exception of the configured TLS ciphers, which are reset to the default values. so yeah, your ciphers get a little reset, that's just how it is 🫶

SSL objects you already created from this SSL_CTX with SSL_new(3)? not affected, bestie. they're doing their own thing. the one exception is when SSL_clear(3) is being called, as described below 👇

SSL_CTX_get_ssl_method() returns the SSL_METHOD which was used to construct the SSL_CTX. it's giving "who made me" energy 😌

SSL_set_ssl_method() sets a new TLS/SSL method for a particular ssl object. it may be reset, when SSL_clear() is called. lowkey fragile, but ok ⭐

SSL_get_ssl_method() returns a pointer to the TLS/SSL method set in ssl. simple, iconic, no notes 💜

🦋 NOTES 🦋

the available method choices are described in SSL_CTX_new(3). go look, i'll wait 🧚

when SSL_clear(3) is called and no session is connected to an SSL object, the method of the SSL object is reset to the method currently set in the corresponding SSL_CTX object. so it snaps back to the parent's vibe, fr fr 🌈

⚠️ SSL_CTX_set_version() has unusual semantics and no clear use case; it would usually be preferable to create a new SSL_CTX object than to try to reuse an existing one in this fashion. its usage is considered deprecated. like, not me warning you 💀 this one's a red flag, just make a fresh ctx.

also SSL_set_ssl_method() cannot be used to change a non-QUIC SSL object to a QUIC SSL object or vice versa, or change a QUIC SSL object from one QUIC method to another. QUIC stays QUIC, non-QUIC stays non-QUIC. no crossover episodes 🙈

⭐ RETURN VALUES ⭐

the following return values can occur for SSL_CTX_set_ssl_version() and SSL_set_ssl_method():

  • 0 — the new choice failed, check the error stack to find out the reason 😭
  • 1 — the operation succeeded 🔥

SSL_CTX_get_ssl_method() and SSL_get_ssl_method() always return non-NULL pointers. always. no cap 👑

🎀 SEE ALSO 🎀

go read them, i'm literally begging you 🍓

💜 HISTORY 💜

SSL_CTX_set_ssl_version() was deprecated in OpenSSL 3.0. she's retired, respect her legacy ✨

Copyright 2000-2023 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page, you ate that 💅 this was version 3.5.0, dated 2026-09-25, living in the SSL_CTX_SET_SSL_VERSION(3ossl) manual. mwah, go forth and pick your methods wisely, bestie 🫶🌸

📦 where this page comes from