SSL_CTX_SET_...PROTO_VERSION(3ossl)

💖 SSL_CTX_SET_...PROTO_VERSION 💖

okay bestie, welcome to the 3ossl manual page, and trust, this one is a whole vibe. it's giving "stop turning off TLS versions by hand, i'm begging you" ✨

---

🌸 NAME 🌸

SSL_CTX_set_min_proto_version, SSL_CTX_set_max_proto_version, SSL_CTX_get_min_proto_version, SSL_CTX_get_max_proto_version, SSL_set_min_proto_version, SSL_set_max_proto_version, SSL_get_min_proto_version, SSL_get_max_proto_version — get and set the minimum and maximum supported protocol version, no cap 🎀

---

🦋 SYNOPSIS 🦋

#include <openssl/ssl.h>

int SSL_CTX_set_min_proto_version(SSL_CTX *ctx, int version);
int SSL_CTX_set_max_proto_version(SSL_CTX *ctx, int version);
int SSL_CTX_get_min_proto_version(SSL_CTX *ctx);
int SSL_CTX_get_max_proto_version(SSL_CTX *ctx);

int SSL_set_min_proto_version(SSL *ssl, int version);
int SSL_set_max_proto_version(SSL *ssl, int version);
int SSL_get_min_proto_version(SSL *ssl);
int SSL_get_max_proto_version(SSL *ssl);

like look at that symmetry. the ctx girlies and the ssl girlies, living their parallel lives 💅

---

✨ DESCRIPTION ✨

so these functions get or set the minimum and maximum supported protocol versions for the ctx or the ssl. that's the whole job, and they do it gorgeously.

they work in combination with the options you set via SSL_CTX_set_options(3), which also make it possible to disable specific protocol versions. BUT — and this is the main character plot twist — use these functions instead of disabling specific protocol versions. that's not a suggestion, that's the instruction. periodt. 👑

setting the minimum or maximum version to 0 (that's the default, btw) will enable protocol versions down to the lowest version, or up to the highest version supported by the library, respectively. and the supported versions might be controlled by system configuration, so it's not always just about you, bestie.

the getters return 0 in case ctx or ssl have been configured to automatically use the lowest or highest version supported by the library. so if you get a 0 back, that's not an error, that's just her being flexible 🧚

currently supported versions are:

• SSL3_VERSION
• TLS1_VERSION
• TLS1_1_VERSION
• TLS1_2_VERSION
• TLS1_3_VERSION

for TLS — and for DTLS you've got:

• DTLS1_VERSION
• DTLS1_2_VERSION

heads up bestie: in the current version of OpenSSL only QUICv1 is supported in conjunction with TLSv1.3. calling these functions on a QUIC object has no effect. like, nothing. she's not listening. 😭

---

💜 RETURN VALUES 💜

• the setter functions return 1 on success and 0 on failure. iconic behaviour, honestly.
• the getter functions return the configured version, or 0 for auto-configuration of lowest or highest protocol, respectively.

---

🎀 NOTES 🎀

all these functions are implemented using macros. so if you were planning to take their address or something weird — nope, they're macros, iykyk 🙈

---

👑 SEE ALSO 👑

ssl(7), SSL_CTX_set_options(3), SSL_CONF_cmd(3)

go read them, they're all part of the same friend group 💖

---

🌈 HISTORY 🌈

• the setter functions were added in OpenSSL 1.1.0
• the getter functions were added in OpenSSL 1.1.1

glow-up timeline fr fr ⭐

---

🫶 COPYRIGHT 🫶

Copyright 2016-2025 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page, bestie!! this was OpenSSL 3.5.9, dated 2026-09-2 — mwah, go set your proto versions responsibly 💅💖✨