SSL_GET_SHARED_SIGALGS(3ossl)

📦 version 3.5.0, in opensuse-leap 16.0

💖 SSL_GET_SHARED_SIGALGS(3ossl) 💖

okay so bestie, welcome to the 3ossl manual, and buckle up because today we're talking about signature algorithms — specifically, how to peek at which ones your TLS peer is willing to vibe with. no cap, this is lowkey one of the cutest little introspection pages in OpenSSL. 🦋

✨ SYNOPSIS ✨

#include <openssl/ssl.h>

int SSL_get_shared_sigalgs(SSL *s, int idx,
                           int *psign, int *phash, int *psignhash,
                           unsigned char *rsig, unsigned char *rhash);

int SSL_get_sigalgs(SSL *s, int idx,
                    int *psign, int *phash, int *psignhash,
                    unsigned char *rsig, unsigned char *rhash);

two functions, same shape, slightly different energy. let's get into it 💅

🌸 DESCRIPTION 🌸

SSL_get_shared_sigalgs() — the "what do we both agree on" one 🫶

this one hands you the tea about the shared signature algorithms supported by the peer s. iconic behaviour honestly.

the parameter idx tells it which shared signature algorithm you want, and it starts counting from zero — yes, zero-indexed, we love a classic.

here's where everything gets written:

  • the signature algorithm NID goes into *psign
  • the hash NID goes into *phash
  • the sign and hash NID goes into *psignhash
  • the raw signature and hash values go into *rsig and *rhash

SSL_get_sigalgs() — the "give me everything" one 💀

this one is basically the same as SSL_get_shared_sigalgs(), except it returns info about all signature algorithms supported by s, in the exact order they were sent by the peer. so it's not the shared set, it's the peer's whole little list. main character energy fr fr.

👑 RETURN VALUES 👑

both SSL_get_shared_sigalgs() and SSL_get_sigalgs() return the number of signature algorithms, or 0 if the idx parameter is out of range. that's it, that's the return value. simple, clean, slay. ✨

🎀 NOTES 🎀

okay this is the section where all the important lore lives, so pay attention bestie:

  • these functions are typically called for debugging purposes (like, to report the peer's preferences) or when an application wants finer control over certificate selection. but honestly? most applications will just rely on the internal handling and won't need to call them at all. no notes. 🙈
  • if all you care about is the highest preference shared signature algorithm, just set idx to zero and you're done. easy.
  • any or all of the parameters psign, phash, psignhash, rsig or rhash can be set to NULL if you don't need that value. and here's a cute trick: set them all to NULL, set idx to zero, and you can determine the total number of signature algorithms — which, plot twist, can be zero. 😭
  • timing matters, so listen up: these functions must be called after the peer has sent a list of supported signature algorithms — that means after a client hello (if you're a server) or after a certificate request (if you're a client). they can, for example, be called in the certificate callback. 🧚
  • only TLS 1.2, TLS 1.3 and DTLS 1.2 currently support signature algorithms. if you call these functions on an earlier version of TLS or DTLS, you get zero back. harsh but fair. 💀
  • the shared signature algorithms returned by SSL_get_shared_sigalgs() are ordered according to configuration and peer preferences.
  • the raw values correspond to the on the wire form as defined by RFC5246 et al. the NIDs are OpenSSL equivalents. for example: if the peer sent sha256(4) and rsa(1) then *rhash would be 4, *rsign would be 1, *phash would be NID_sha256, *psig would be NID_rsaEncryption and *psignhash would be NID_sha256WithRSAEncryption. obsessed with a clean mapping honestly. 🌈
  • if a signature algorithm is not recognised, the corresponding NIDs get set to NID_undef. this may be because the value isn't supported, isn't an appropriate combination (for example MD5 and DSA), or the signature algorithm doesn't use a hash at all (for example Ed25519). 💅

🦋 SEE ALSO 🦋

Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the page!! 🍓 this has been your girl signing off — version 3.5.0, dated 2026-09-25, brought to you by OpenSSL, still out here being SSL_GET_SHARED_SIGALGS(3ossl) and eating every single time. mwah 💋 periodt.

📦 where this page comes from