EVP_SET_DEFAULT_PROPERTIES(3ssl)

💅 EVP_SET_DEFAULT_PROPERTIES — manage default properties for future algorithm fetches

okay so this is the 3ssl manual page, bestie, and it's literally about setting the default properties that every future algorithm fetch will use. no cap, it's giving "set it once, vibe check everything after." ✨

---

🌸 SYNOPSIS 🌸

#include <openssl/evp.h>

int EVP_set_default_properties(OSSL_LIB_CTX *libctx, const char *propq);
char *EVP_get1_default_properties(OSSL_LIB_CTX *libctx);
int EVP_default_properties_enable_fips(OSSL_LIB_CTX *libctx, int enable);
int EVP_default_properties_is_fips_enabled(OSSL_LIB_CTX *libctx);
#define FIPS_mode() EVP_default_properties_is_fips_enabled(NULL)

---

🎀 DESCRIPTION 🎀

EVP_set_default_properties() sets the default properties for all future EVP algorithm fetches — implicit and explicit. it's the main character of this whole page tbh. if you wanna know what implicit and explicit fetching even are, go peek at "ALGORITHM FETCHING" in crypto(7).

EVP_set_default_properties stores the properties you hand it in the string propq among the EVP data that's been stored in the library context given by libctx (and NULL signifies the default library context, iykyk).

any previous default property for the library context you specified? yeah, it gets dropped. gone. 💀

EVP_get1_default_properties() gets the default properties set for all future EVP algorithm fetches — implicit as well as explicit — for that specific library context.

EVP_default_properties_enable_fips() sets 'fips=yes' to be a default property if enable is non zero. otherwise it clears 'fips' from the default property query for the given libctx. and the way it merges the fips default property query with any existing query strings that have been set via EVP_set_default_properties()? obsessed. 🫶

EVP_default_properties_is_fips_enabled() indicates if 'fips=yes' is a default property for the given libctx.

---

⚠️ NOTES ⚠️

EVP_set_default_properties() and EVP_default_properties_enable_fips() are not thread safe. like, at all. they're intended to be called only during the initialisation phase of a libctx. so please don't be messy about it. 🙈

EVP_get1_default_properties() is also not thread safe. the application must ensure that the context reference is valid and that default fetching properties are not being modified by a different thread.

EVP_default_properties_is_fips_enabled() and FIPS_mode() are hints of intent — but not proof. if you're looking to validate whether the default configuration is using a validated module, many additional checks are needed. please consult the documentation of the provider you're using and the associated security policy. seriously bestie, don't skip this one. 🔥

---

✨ RETURN VALUES ✨

• EVP_set_default_properties() and EVP_default_properties_enable_fips() return 1 on success, or 0 on failure. an error is placed on the error stack if a failure occurs.
• EVP_default_properties_is_fips_enabled() returns 1 if the 'fips=yes' default property is set for the given libctx, otherwise it returns 0.
• EVP_get1_default_properties() returns allocated memory that must be freed by OPENSSL_free(3) on success, and NULL on failure. free your memory, bestie, it's the bare minimum. 🧚
• FIPS_mode() is a convenience define which calls EVP_default_properties_is_fips_enabled(NULL) against the default library context.

---

🦋 SEE ALSO 🦋

EVP_MD_fetch(3)

---

👑 HISTORY 👑

• the functions EVP_set_default_properties(), EVP_default_properties_enable_fips(), EVP_default_properties_is_fips_enabled() were added in OpenSSL 3.0.
• the function EVP_get1_default_properties() was added in OpenSSL 3.5.
• FIPS_mode() is restored as a define to EVP_default_properties_is_fips_enabled(NULL) in OpenSSL 4.1.

---

🌈 COPYRIGHT 🌈

Copyright 2019-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page, bestie 💜 this was OpenSSL 4.1.0, dated 2026-10-23, and it lives in section 3ssl of the manual. slay, go set some defaults. periodt. 🎀✨