SSL_CTX_SET_...PROTO_VERSION(3ossl)

📦 version 3.5.0, in opensuse-leap 16.0

💅 SSL_CTX_set_min_proto_version, and the whole squad — get/set the min & max protocol versions

okay bestie, so this is the 3ossl manual page (that's the OpenSSL girlies, obvi) and honestly? it's a glow-up for your TLS config. let's get into it ✨

🌸 NAME

  • SSL_CTX_set_min_proto_version, SSL_CTX_set_max_proto_version, SSL_CTX_get_min_proto_version, SSL_CTX_get_max_proto_version
  • SSL_set_min_proto_version, SSL_set_max_proto_version, SSL_get_min_proto_version, SSL_get_max_proto_version

that whole friend group's job? get and set the minimum and maximum supported protocol version, no cap 🫶

✨ SYNOPSIS

like, plug in the header first:

#include <openssl/ssl.h>

then the SSL_CTX girlies (they're the context ones, the group-chat admins of your config):

int SSL_CTX_set_min_proto_version(SSL_CTX *ctx, int version);
int SSL_CTX_set_max_proto_version(SSL_CTX *ctx, int version);
int SSL_CTX_get_min_proto_version(SSL_CTX *ctx);
int SSL_CTX_get_max_proto_version(SSL_CTX *ctx);

and then the SSL ones (each individual connection, main character energy):

int SSL_set_min_proto_version(SSL *ssl, int version);
int SSL_set_max_proto_version(SSL *ssl, int version);
int SSL_get_min_proto_version(SSL *ssl);
int SSL_get_max_proto_version(SSL *ssl);

🦋 DESCRIPTION

so these functions get or set the minimum and maximum supported protocol versions for the ctx or the ssl. 💖

the way it works: it plays nice in combination with the options set via SSL_CTX_set_options(3), which also make it possible to disable specific protocol versions. but bestie, listen to me — use these functions instead of disabling specific protocol versions, okay? that's the vibe. periodt.

setting the minimum or maximum version to 0 will enable protocol versions down to the lowest version, or up to the highest version supported by the library, respectively. so 0 is literally just "whatever, library, you decide" 🌈

the getters return 0 in case ctx or ssl have been configured to automatically use the lowest or highest version supported by the library. so if you get a 0 back, that's not an error, that's just auto-mode being its cute self.

currently supported versions are SSL3_VERSION, TLS1_VERSION, TLS1_1_VERSION, TLS1_2_VERSION, TLS1_3_VERSION for TLS and DTLS1_VERSION, DTLS1_2_VERSION for DTLS. write them down, iykyk 💅

and a little plot twist 🫢 — in the current version of OpenSSL only QUICv1 is supported in conjunction with TLSv1.3. calling these functions on a QUIC object has no effect. like, at all. it's giving "seen at 3am, no reply" 😭

👑 RETURN VALUES

the setter girlies return 1 on success and 0 on failure. slay or flop, no in-between 💀

the getter girlies return the configured version, or 0 for auto-configuration of lowest or highest protocol, respectively.

🎀 NOTES

all these functions are implemented using macros. that's it, that's the note, short and iconic ⭐

🔥 SEE ALSO

go read them, they're the supporting cast and they ate 🫶

💜 HISTORY

the setter functions were added in OpenSSL 1.1.0. the getter functions were added in OpenSSL 1.1.1. growth, evolution, character development 🌱✨

Copyright 2016-2023 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page bestie 💖 this was version 3.5.0, dated 2026-09-2 — signed off with a little sparkle, a little bow, and zero disabled protocol versions 🎀✨🦋

📦 where this page comes from