SSL_GET0_PEER_RPK(3ossl)

📦 version 3.5.0, in opensuse-leap 16.0

🦋 NAME 🦋

okay bestie, welcome to the SSL_get0_peer_rpk(3ossl) page — it's all about raw public key (RFC7250) support ✨ and these are the main characters:

  • SSL_add_expected_rpk
  • SSL_get_negotiated_client_cert_type
  • SSL_get_negotiated_server_cert_type
  • SSL_get0_peer_rpk
  • SSL_SESSION_get0_peer_rpk

✨ SYNOPSIS ✨

#include <openssl/ssl.h>

int SSL_add_expected_rpk(SSL *s, EVP_PKEY *rpk);
int SSL_get_negotiated_client_cert_type(const SSL *s);
int SSL_get_negotiated_server_cert_type(const SSL *s);
EVP_PKEY *SSL_get0_peer_rpk(const SSL *s);
EVP_PKEY *SSL_SESSION_get0_peer_rpk(const SSL_SESSION *ss);

💖 DESCRIPTION 💖

  • SSL_add_expected_rpk(SSL *s, EVP_PKEY *rpk) — adds a DANE TLSA record matching public key rpk to SSL s's DANE validation policy. literally adding a trusted-key receipt to the vibe check 🧾
  • SSL_get_negotiated_client_cert_type(const SSL *s) — returns the connection's negotiated client certificate type. what did we agree on for the client cert moment? 💅
  • SSL_get_negotiated_server_cert_type(const SSL *s) — returns the connection's negotiated server certificate type. same energy, but for the server side 🫶
  • SSL_get0_peer_rpk(const SSL *s) — returns the peer's raw public key from SSL s. gimme the peer's raw public key pls 🔑
  • SSL_SESSION_get0_peer_rpk(const SSL_SESSION *ss) — returns the peer's raw public key from SSL_SESSION ss. same key-hunting energy, but from the session 🎀

🎀 NOTES 🎀

Raw public keys are used in place of certificates when the option is negotiated. no cap, that's the whole setup 💫

SSL_add_expected_rpk() may be called multiple times to configure multiple trusted keys. This makes it possible to allow for key rotation, where a peer might be expected to offer an "old" or "new" key and the endpoint must be able to accept either one. key rotation? we love a graceful era transition 🔄

When raw public keys are used, the certificate verify callback is called, and may be used to inspect the public key via X509_STORE_CTX_get0_rpk(3). Raw public keys have no subject, issuer, validity dates nor digital signature to verify. They can, however, be matched verbatim or by their digest value; this is done by specifying one or more TLSA records, see SSL_CTX_dane_enable(3). no subject, no issuer, no dates, no signature — it's giving minimalist icon behavior 💀

The raw public key is typically taken from the certificate assigned to the connection (e.g. via SSL_use_certificate(3)), but if a certificate is not configured, then the public key will be extracted from the assigned private key. so it's either cert-sourced or private-key-sourced — tracked, bestie 🧚

The SSL_add_expected_rpk() function is a wrapper around SSL_dane_tlsa_add(3). When DANE is enabled via SSL_dane_enable(3), the configured TLSA records will be used to validate the peer's public key or certificate. If DANE is not enabled, then no validation will occur. important: no DANE enabled means no validation, periodt 🚨

🫶 RETURN VALUES 🫶

SSL_add_expected_rpk() returns 1 on success and 0 on failure. simple binary slay ✅

SSL_get0_peer_rpk() and SSL_SESSION_get0_peer_rpk() return the peer's raw public key as an EVP_PKEY or NULL when the raw public key is not available. if it's not there, it's a big ol' NULL 😭

SSL_get_negotiated_client_cert_type() and SSL_get_negotiated_server_cert_type() return one of the following values:

  • TLSEXT_cert_type_x509
  • TLSEXT_cert_type_rpk

those two are the whole menu, iykyk 💅

🌈 SEE ALSO 🌈

👑 HISTORY 👑

These functions were added in OpenSSL 3.2. new-ish era, iconic behavior 🌟

Copyright 2023 The OpenSSL Project Authors. All Rights Reserved.

xoxo, your Unix bestie 💖 — this page is from OpenSSL 3.5.0, dated 2026-09-25, and yes, SSL_GET0_PEER_RPK(3ossl) ate and left no crumbs 🎀🫶

📦 where this page comes from