SSL_GET0_PEER_RPK(3ossl)

📦
version 3.5.9 · 8 versions
, in fedora 43, fedora 44

💖 SSL_GET0_PEER_RPK 💖

okay bestie, sit down, hydrate, and let me tell you about raw public keys, because this is the 3ossl manual page for SSL_GET0_PEER_RPK and it is lowkey iconic. we're talking RFC7250 support — raw public key energy, no certificate drama, just vibes and keys. 🦋

✨ NAME ✨

SSL_add_expected_rpk, SSL_get_negotiated_client_cert_type, SSL_get_negotiated_server_cert_type, SSL_get0_peer_rpk, SSL_SESSION_get0_peer_rpk — raw public key (RFC7250) support, bestie. that's the whole squad. 🫶

🌸 SYNOPSIS 🌸

#include <openssl/ssl.h>

int SSL_add_expected_rpk(SSL *s, EVP_PKEY *rpk);
int SSL_get_negotiated_client_cert_type(const SSL *s);
int SSL_get_negotiated_server_cert_type(const SSL *s);
EVP_PKEY *SSL_get0_peer_rpk(const SSL *s);
EVP_PKEY *SSL_SESSION_get0_peer_rpk(const SSL_SESSION *ss);

like, that's the whole cast list. no notes. 💅

🎀 DESCRIPTION 🎀

  • SSL_add_expected_rpk() — adds a DANE TLSA record matching public key rpk to SSL s's DANE validation policy. she's adding a trusted key to the list, periodt.
  • SSL_get_negotiated_client_cert_type() — returns the connection's negotiated client certificate type. what did y'all agree on? this tells you.
  • SSL_get_negotiated_server_cert_type() — returns the connection's negotiated server certificate type. same energy, server side.
  • SSL_get0_peer_rpk() — returns the peer's raw public key from SSL s. the actual key, no certificate wrapper, just the raw thing. 🔥
  • SSL_SESSION_get0_peer_rpk() — returns the peer's raw public key from SSL_SESSION ss. same vibe, but from the session instead.

🦋 NOTES 🦋

so here's the tea. raw public keys get used in place of certificates when the option is negotiated. no cap.

SSL_add_expected_rpk() may be called multiple times to configure multiple trusted keys. why would you do that? key rotation, bestie. a peer might be expected to offer an "old" or "new" key, and the endpoint must be able to accept either one. slay. 👑

when raw public keys are used, the certificate verify callback is called, and it may be used to inspect the public key via X509_STORE_CTX_get0_rpk(3). and listen — raw public keys have no subject, issuer, validity dates nor digital signature to verify. they're giving minimalist. but they can be matched verbatim or by their digest value, and that's done by specifying one or more TLSA records, see SSL_CTX_dane_enable(3). iykyk.

the raw public key is typically taken from the certificate assigned to the connection (e.g. via SSL_use_certificate(3)), but if a certificate is not configured, then the public key will be extracted from the assigned private key. she adapts. 💁

SSL_add_expected_rpk() is a wrapper around SSL_dane_tlsa_add(3). when DANE is enabled via SSL_dane_enable(3), the configured TLSA records will be used to validate the peer's public key or certificate. and if DANE is not enabled? then no validation will occur. 🫠

not me telling you that skipping DANE means zero validation — like, none, bestie. if you wanted vibes-only crypto, that's how you get it. enable DANE if you want the TLSA records to actually do their job. 🙈

💜 RETURN VALUES 💜

  • SSL_add_expected_rpk() returns 1 on success and 0 on failure. classic.
  • SSL_get0_peer_rpk() and SSL_SESSION_get0_peer_rpk() return the peer's raw public key as an EVP_PKEY or NULL when the raw public key is not available. no key, no EVP_PKEY, just NULL. 😭
  • SSL_get_negotiated_client_cert_type() and SSL_get_negotiated_server_cert_type() return one of the following values:
TLSEXT_cert_type_x509
TLSEXT_cert_type_rpk

like, pick one. those are the options. ⭐

🌈 SEE ALSO 🌈

go read them. they're the extended universe. 📚

⭐ HISTORY ⭐

these functions were added in OpenSSL 3.2. so if you're on something older, bestie, i'm so sorry, you don't have these. upgrade arc. 🧚

Copyright 2023 The OpenSSL Project Authors. All Rights Reserved.

and that's the whole page, bestie!! this was OpenSSL 3.5.9, dated 2026-09-29, and you just read SSL_GET0_PEER_RPK(3ossl) in full. raw public keys, DANE records, key rotation — we ate and left no crumbs. 💅✨ mwah, go forth and negotiate some cert types. 🎀🦋💖

📦 where this page comes from