EVP_PKEY_GET...LT_DIGEST_NID(3SSL)

📦
version 4.0.3 · 13 versions
, in ubuntu stonking

💖 EVP_PKEY_get_default_digest_nid — get default signature digest 💖

okay bestie, welcome to the OpenSSL 3SSL manual party 🎀 this little page is all about the two functions that tell you which message digest your key wants to use when it's out here signing stuff. it's giving "who's the default bestie" energy, and honestly? iconic.

✨ NAME ✨

EVP_PKEY_get_default_digest_nid, EVP_PKEY_get_default_digest_name — get default signature digest

🌸 SYNOPSIS 🌸

#include <openssl/evp.h>

int EVP_PKEY_get_default_digest_name(EVP_PKEY *pkey,
                                     char *mdname, size_t mdname_sz);
int EVP_PKEY_get_default_digest_nid(EVP_PKEY *pkey, int *pnid);

🦋 DESCRIPTION 🦋

so, EVP_PKEY_get_default_digest_name() is the one that fills in the default message digest name for the public key signature operations that go with the key pkey. it drops that name into mdname, and the way it's written, it'll use at most mdname_sz bytes including the ending NUL byte. so like, mind your buffer, bestie, that NUL is part of the count 🫶

and the name it gives you could literally be "UNDEF" — which is a whole vibe meaning that the digest must (when the return value is 2) or may (when the return value is 1) be left unspecified. not me being mysterious on purpose 💅

meanwhile EVP_PKEY_get_default_digest_nid() sets pnid to the default message digest NID for the public key signature operations associated with key pkey. but heads up: some signature algorithms — literally calling out Ed25519 and Ed448 📣 — do not use a digest during signing. in that case pnid gets set to NID_undef. and ngl, this function is only reliable for legacy keys — which are typically the ones created with EVP_PKEY_assign_RSA(3) or similar. so if you're rolling with new-school keys, don't count on it fr fr.

📝 NOTES 📝

tiny but important, no cap: for all current standard OpenSSL public key algorithms, SHA256 is what gets returned. one digest to rule them all, periodt.

👑 RETURN VALUES 👑

both EVP_PKEY_get_default_digest_name() and EVP_PKEY_get_default_digest_nid() hand back:

  • 1 — when the message digest is advisory, meaning other digests can still be used (it's a suggestion, not a rule 💅)
  • 2 — when it's mandatory, meaning other digests can not be used (sorry bestie, no swaps 🚫)

and for the not-so-great days:

  • 0 or a negative value — failure 😭
  • -2 specifically — the operation is not supported by the public key algorithm. that's the "this isn't a me problem, it's a your-algorithm problem" code 💀

🔥 SEE ALSO 🔥

go read these next, they're the group chat:

🌈 HISTORY 🌈

this function first showed up way back in OpenSSL 1.0.0. a true OG, she's been here since before it was cool 👑

Copyright 2006-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page bestie, drink some water and go sign something responsibly 🫶

sources say this was 4.0.3 vibes, dated 2026-09-29, straight from the OpenSSL crew — mwah, stay slay 💅✨

📦 where this page comes from