SSL_GET_SHARED_SIGALGS(3ossl)

✨ NAME ✨

SSL_get_shared_sigalgs, SSL_get_sigalgs — bestie, this is literally your ✨signature algorithm✨ lookup situation. We're talking OpenSSL 3ossl here, so you're in the right docs, iykyk 💅

---

🌸 SYNOPSIS 🌸

okay so like, first you gotta include the header:

#include <openssl/ssl.h>

then these two absolute icons walk in:

int SSL_get_shared_sigalgs(SSL *s, int idx,
                           int *psign, int *phash, int *psignhash,
                           unsigned char *rsig, unsigned char *rhash);

int SSL_get_sigalgs(SSL *s, int idx,
                    int *psign, int *phash, int *psignhash,
                    unsigned char *rsig, unsigned char *rhash);

no cap, that's a lot of pointers, but we're gonna get through it together 🫶

---

💖 DESCRIPTION 💖

SSL_get_shared_sigalgs()

So this one returns info about the shared signature algorithms supported by peer s. It's giving "what do we both agree on" energy ✨

The parameter idx tells you which shared signature algorithm to hand back, and bestie, it starts from zero. Zero-based indexing, we love to see it 🙈

Then the gossip gets distributed like this:

• the signature algorithm NID gets written to *psign
• the hash NID goes to *phash
• the sign and hash NID lands in *psignhash
• and the raw signature and hash values get written to *rsig and *rhash

SSL_get_sigalgs()

This one is like the sibling of SSL_get_shared_sigalgs() except — and this is the whole plot twist — it returns info about all signature algorithms supported by s, in the exact order the peer sent them 👑

---

🔥 RETURN VALUES 🔥

Both SSL_get_shared_sigalgs() and SSL_get_sigalgs() return the number of signature algorithms, or 0 if the idx parameter is out of range.

lowkey if you get a 0 back, check your idx, bestie, you probably wandered off the edge of the list 😭

---

🦋 NOTES 🦋

okay so the vibe check on these functions: they're typically called for debugging purposes (like, reporting the peer's preferences) or when an application wants finer control over certificate selection. Most applications will just rely on internal handling and will not need to call them at all. so like, no pressure, you don't have to use these 💅

If an application is only interested in the highest preference shared signature algorithm, it can just set idx to zero. one and done, slay ✨

Any or all of the parameters psign, phash, psignhash, rsig or rhash can be set to NULL if the value is not required. and the iconic move: by setting them all to NULL and setting idx to zero, the total number of signature algorithms can be determined — which can be zero. 💀

🚨 these functions must be called after the peer has sent a list of supported signature algorithms: after a client hello (for servers) or a certificate request (for clients). They can (for example) be called in the certificate callback.

Only TLS 1.2, TLS 1.3 and DTLS 1.2 currently support signature algorithms. If these functions are called on an earlier version of TLS or DTLS, zero is returned. not me getting zero because my protocol is too old 😭

The shared signature algorithms returned by SSL_get_shared_sigalgs() are ordered according to configuration and peer preferences. so the order is not random, it's a whole ranking situation 👑

The raw values correspond to the on the wire form as defined by RFC5246 et al. The NIDs are OpenSSL equivalents. For example, if the peer sent sha256(4) and rsa(1) then:

• *rhash would be 4
• *rsign 1
• *phash NID_sha256
• *psig NID_rsaEncryption
• and *psignhash NID_sha256WithRSAEncryption

periodt 💅

If a signature algorithm is not recognised, the corresponding NIDs will be set to NID_undef. This may be because:

• the value is not supported
• it's not an appropriate combination (for example MD5 and DSA)
• or the signature algorithm does not use a hash (for example Ed25519)

so like, NID_undef is the "idk her" of NIDs 🌸

---

🌈 SEE ALSO 🌈

• SSL_CTX_set_cert_cb(3)
• ssl(7)

---

👑 COPYRIGHT 👑

Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page, bestie 🎀 version 3.5.9, dated 2026-09-29, from the SSL_GET_SHARED_SIGALGS(3ossl) crew. go forth and inspect those sigalgs, you absolute main character 🦋✨💖