SSL_NEW_DOMAIN(3ossl)

💖 SSL_NEW_DOMAIN(3ossl) 💖

okay bestie, welcome to the OpenSSL manual, this one's all about SSL_new_domain, SSL_is_domain and SSL_get0_domain — the whole lil friend group that handles QUIC event domains. it's giving "SSL object interface for managing QUIC event domains" and honestly? iconic. ✨

---

🌸 NAME 🌸

SSL_new_domain, SSL_is_domain, SSL_get0_domain — the SSL object interface for managing QUIC event domains. yes we're doing QUIC things, no it's not scary, stay with me 🫶

---

✨ SYNOPSIS ✨

#include <openssl/ssl.h>

SSL *SSL_new_domain(SSL_CTX *ctx, uint64_t flags);

int SSL_is_domain(SSL *ssl);
SSL *SSL_get0_domain(SSL *ssl);

---

🦋 DESCRIPTION 🦋

okay so first up: SSL_new_domain() makes you a brand new QUIC event domain, and it represents that domain as an SSL object. the official nickname for this lil guy is a QUIC domain SSL object, or QDSO if you're in a hurry 💅. if you wanna know what a "QUIC event domain" even is, the whole concept gets unpacked in openssl-quic-concurrency(7) — go read it, it eats.

the flags argument to SSL_new_domain() is where you set your domain flags. here's the tea on how that works: if flags does not specify one of SSL_DOMAIN_FLAG_SINGLE_THREAD, SSL_DOMAIN_FLAG_MULTI_THREAD or SSL_DOMAIN_FLAG_THREAD_ASSISTED, then the domain flags that are configured on the SSL_CTX get inherited as a default, and any other flags in flags get added on top of that inherited set. otherwise — like, if you did specify one of those — the domain flags in flags are just used as-is. periodt. for the full rundown of which domain flags exist and how to set them on an SSL_CTX, check SSL_CTX_set_domain_flags(3).

a QUIC domain SSL object gets managed exactly like any other SSL object — you can refcount it, you can free it, business as usual. the thing is, a QUIC domain SSL object is a parent to a bunch of child objects, like QUIC listener SSL objects. and once you've created your domain SSL object, you can make a listener under it with SSL_new_listener_from(3). nesting era 🔥

SSL_is_domain() returns 1 if the SSL object in question is a QUIC domain SSL object. vibe check passed ✅

SSL_get0_domain() hands you a pointer to the QUIC domain SSL object in an SSL object hierarchy (if there even is one).

also, important: all SSL objects inside a QUIC event domain use the same domain flags, and once a QUIC domain is constructed, you cannot change its domain flags. no takebacks, no edits, no glow-ups. 🙈

👑 Supported Operations 👑

a QUIC domain SSL object exists to contain other QUIC SSL objects and to provide unified event handling. so it's a little bit exclusive — it only supports these operations:

• Standard reference counting and free operations, like SSL_up_ref(3) and SSL_free(3);
• Event processing and polling enablement APIs such as SSL_handle_events(3), and SSL_get_event_timeout(3).
• Creating listeners under the domain using SSL_new_listener_from(3).

the basic workflow of using a domain object goes like this:

• Create a new domain object using SSL_new_domain(), using an SSL_CTX which uses a supported SSL_METHOD (such as OSSL_QUIC_server_method(3));
• Create listeners under the domain using SSL_new_listener_from(3).

for all the deets on using listeners, go peek at SSL_new_listener_from(3).

and rn? domain SSL objects are only supported for QUIC usage, via any QUIC SSL_METHOD. that's the whole menu, bestie 🍓

---

💜 RETURN VALUES 💜

• SSL_new_domain() returns a fresh new domain SSL object, or NULL if it failed 😭
• SSL_is_domain() returns 0 or 1, depending on what type of SSL object you called it on
• SSL_get0_domain() returns an SSL object pointer — and yeah, it might be pointing at the very same object you called it on — or NULL

---

🌈 SEE ALSO 🌈

SSL_new_listener_from(3) SSL_handle_events(3), SSL_CTX_set_domain_flags(3), openssl-quic-concurrency(7)

---

⭐ HISTORY ⭐

these functions were added in OpenSSL 3.5. new-ish, but they ate. 👑

---

🎀 COPYRIGHT 🎀

Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page, bestie!! this was OpenSSL 3.5.9, dated 2026-09-29, from the SSL_NEW_DOMAIN(3ossl) manual 💅✨ go build something with QUIC domains, you got this 🫶💖