SSL_GET0_PEER_SCTS(3ossl)
π SSL_GET0_PEER_SCTS π
okay so this is a page from the 3ossl manual β yes, the OpenSSL girlies β and it's all about a tiny function that hands you back your Signed Certificate Timestamps. no cap, it's short but it's iconic. let's get into it π«Ά
β¨ NAME β¨
SSL_get0_peer_scts β literally just "get the SCTs you received," that's the whole vibe π
πΈ SYNOPSIS πΈ
#include <openssl/ssl.h>
const STACK_OF(SCT) *SSL_get0_peer_scts(SSL *s);
π¦ DESCRIPTION π¦
okay so SSL_get0_peer_scts() returns the signed certificate timestamps (SCTs) that have been received. that's it, that's the function π
but here's the little detail that matters: the first time you call this for a given SSL instance, it actually goes digging β it will examine the TLS extensions, the OCSP response, and the peer's certificate looking for SCTs π. every call after that? it just gives you back the same SCTs. cached and cozy, no re-scanning. slay.
π₯ RESTRICTIONS π₯
real talk though, there's a catch, and you need to hear it π
if no Certificate Transparency validation callback has been set β and that's via SSL_CTX_set_ct_validation_callback or SSL_set_ct_validation_callback β then this function is not guaranteed to return all of the SCTs that the peer is capable of sending. like, it might not give you the full set. so don't come for it if SCTs are missing. set your callback, bestie. π
π RETURN VALUES π
SSL_get0_peer_scts() returns a list of the SCTs it found β cute, useful, everything β¨ β or NULL if an error occurs π. that's the whole contract.
π SEE ALSO π
π COPYRIGHT π
Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.
and that's the whole page, bestie π§ β this was 3.5.0, dated 2026-09-25, straight from the 3ossl manual. go forth and check those timestamps π βπ
π¦ where this page comes from
- opensuse-leap 16.0: openssl-3-doc 3.5.0-160000.11.1 Β· Apache-2.0
- π girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on : a language model's rewrite of the original, under its terms