SSL_CTX_SET_DOMAIN_FLAGS(3ossl)

💅 SSL_CTX_set_domain_flags — the OpenSSL 3ossl manual, but make it make sense

okay bestie, sit down, hydrate, and let's talk about QUIC domain concurrency flags ✨ this is the 3ossl page from the OpenSSL fam, and it's literally just "how do we want this QUIC domain to do threads" 🧵🦋

---

🌸 NAME 🌸

SSL_CTX_set_domain_flags, SSL_CTX_get_domain_flags, SSL_get_domain_flags, SSL_DOMAIN_FLAG_SINGLE_THREAD, SSL_DOMAIN_FLAG_MULTI_THREAD, SSL_DOMAIN_FLAG_THREAD_ASSISTED, SSL_DOMAIN_FLAG_BLOCKING, SSL_DOMAIN_FLAG_LEGACY_BLOCKING — these control the concurrency model used by a QUIC domain. that's the whole job, no cap 💖

---

✨ SYNOPSIS ✨

#include <openssl/ssl.h>

#define SSL_DOMAIN_FLAG_SINGLE_THREAD
#define SSL_DOMAIN_FLAG_MULTI_THREAD
#define SSL_DOMAIN_FLAG_LEGACY_BLOCKING
#define SSL_DOMAIN_FLAG_BLOCKING
#define SSL_DOMAIN_FLAG_THREAD_ASSISTED

int SSL_CTX_set_domain_flags(SSL_CTX *ctx, uint64_t flags);
int SSL_CTX_get_domain_flags(SSL_CTX *ctx, uint64_t *flags);

int SSL_get_domain_flags(SSL *ssl, uint64_t *flags);

---

🎀 DESCRIPTION 🎀

so SSL_CTX_set_domain_flags() and SSL_CTX_get_domain_flags() set and get the QUIC domain flags on a SSL_CTX that's using a QUIC SSL_METHOD. these flags decide which concurrency model your QUIC domain runs with. if you want the full lore drop on these concepts, it's all in openssl-quic-concurrency(7) 📚

applications may use either one of the flags here:

• SSL_DOMAIN_FLAG_SINGLE_THREAD — setting this one gets you the Single-Threaded Concurrency Model (SCM). one thread, one vibe, iconic honestly 🙈
• SSL_DOMAIN_FLAG_MULTI_THREAD — setting this configures the Contentive Concurrency Model (CCM)... unless SSL_DOMAIN_FLAG_THREAD_ASSISTED is also specified 👀
  • heads up: if OpenSSL was built without thread support, this is identical to SSL_DOMAIN_FLAG_SINGLE_THREAD. no threads, no problem, just a different model than you asked for 💀
• SSL_DOMAIN_FLAG_THREAD_ASSISTED — setting this configures the Thread-Assisted Concurrency Model (TACM). it implies SSL_DOMAIN_FLAG_MULTI_THREAD and SSL_DOMAIN_FLAG_BLOCKING (package deal, no substitutions 🫶)
  • > this concurrency model is not available if OpenSSL was built without thread support, and if you try to configure it anyway you get an error. periodt.
• SSL_DOMAIN_FLAG_BLOCKING — enables reliable support for blocking I/O calls, and allocates whatever OS resources are necessary to actually pull that off. if this flag is specified, SSL_DOMAIN_FLAG_LEGACY_BLOCKING gets ignored 🚫
• SSL_DOMAIN_FLAG_LEGACY_BLOCKING — enables legacy blocking compatibility mode. see "Legacy Blocking Support Compatibility" in openssl-quic-concurrency(7) 🌈

mutually exclusive flag combos result in an error (for example, combining SSL_DOMAIN_FLAG_SINGLE_THREAD and SSL_DOMAIN_FLAG_MULTI_THREADED) 😭 pick a lane bestie, you cannot do both

because exactly one concurrency model must be chosen, the domain flags cannot be set to 0 — and attempting to do so will result in an error. zero is not an option, literally 🚫✨

changing these flags using SSL_CTX_set_domain_flags() has no effect on QUIC domains which have already been created. the domains already out here living their lives, you can't retroactively change their whole personality 💅

the default set of domain flags set on a newly created SSL_CTX may vary by OpenSSL version, chosen SSL_METHOD, and operating environment. see openssl-quic-concurrency(7) for the details. an application can retrieve the default domain flags by calling SSL_CTX_get_domain_flags() immediately after constructing a SSL_CTX — like, right after, before anything else gets a chance to touch it 🕵️♀️

SSL_get_domain_flags() retrieves the domain flags which are effective for a QUIC domain when called on any QUIC SSL object under that domain. iykyk 🌟

---

🔥 RETURN VALUES 🔥

SSL_CTX_set_domain_flags(), SSL_CTX_get_domain_flags() and SSL_get_domain_flags() return 1 on success and 0 on failure. one is the slay, zero is the sad 😔

SSL_CTX_set_domain_flags() fails if called with a set of flags which are inconsistent or which cannot be supported given the current environment.

SSL_CTX_set_domain_flags() and SSL_CTX_get_domain_flags() fail if called on a SSL_CTX which is not using a QUIC SSL_METHOD.

SSL_get_domain_flags() fails if called on a non-QUIC SSL object.

---

👑 SEE ALSO 👑

SSL_new_domain(3), openssl-quic-concurrency(7)

---

⭐ HISTORY ⭐

these functions were added in OpenSSL 3.5. new era, new flags 🎉

---

💜 COPYRIGHT 💜

Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page bestie 🫶 this was SSL_CTX_SET_DOMAIN_FLAGS(3ossl) from OpenSSL, version 3.5.9, dated 2026-09-29 — go configure your concurrency model and be free, ily 💖✨