OSSL_TRACE_SET_CHANNEL(3SSL)

📦

version 4.0.3 · 13 versions

💅 OSSL_TRACE_SET_CHANNEL(3SSL) — the OpenSSL trace channel glow-up guide 🦋

okay bestie, sit down, hydrate, because we're talking about OSSL_TRACE_SET_CHANNEL from the OpenSSL 3SSL manual — the one that's literally titled Enabling trace output. yes we're getting into the library's internal gossip stream. it's giving backstage pass energy. 🔥

✨ NAME ✨

OSSL_trace_set_channel, OSSL_trace_set_prefix, OSSL_trace_set_suffix, OSSL_trace_set_callback, OSSL_trace_cb — enabling trace output. that's the whole squad, they always show up together. 👑

🌸 SYNOPSIS 🌸

#include <openssl/trace.h>

typedef size_t (*OSSL_trace_cb)(const char *buf, size_t cnt,
                                int category, int cmd, void *data);

void OSSL_trace_set_channel(int category, BIO *bio);
void OSSL_trace_set_prefix(int category, const char *prefix);
void OSSL_trace_set_suffix(int category, const char *suffix);
void OSSL_trace_set_callback(int category, OSSL_trace_cb cb, void  *data);

look at them. four little void functions and one typedef. no cap, that's the entire vibe. 💖

💜 DESCRIPTION 💜

so, if it's available (go read "Configure Tracing" below, it's not always on, unfortunately 😭), your application can ask for internal trace output. and this output? it's free text, for humans to read. cozy. readable. iconic.

this trace output is split into categories, and every category can be switched on all by itself. how? by attaching a so-called trace channel to it. and the simplest possible channel is literally just a BIO object that the application writes the tracing output for that category into. boom. done. ✨

or, if you want to be extra, the application can hand over a tracer callback so it gets way more finegrained trace info. internally, that callback gets wrapped up in a dedicated BIO object — it's giving gift-wrapped. 🎀

and here's the thing: to the tracing code, both channel types are completely indistinguishable. we call them a simple trace channel and a callback trace channel. adorable, right?

OSSL_TRACE_ENABLED(3) is your girl for checking whether tracing is currently enabled for a given category. and if you want to actually produce free-text trace output, that's OSSL_TRACE1(3) and friends, plus macros like OSSL_TRACE_BEGIN(3). 🫶

🧚 Functions 🧚

OSSL_trace_set_channel() — enables the given trace category by attaching the BIO bio object as a (simple) trace channel. on success, ownership of the BIO is transferred to the channel, so the caller must not free it directly. don't do it. put the BIO_free down. 🙈
OSSL_trace_set_prefix() and OSSL_trace_set_suffix() — these let you add an extra line for each channel, output before and after a group of tracing output. what counts as an "output group"? not your call, bestie — that's decided by the code that produces the output. also, the lines given here are considered immutable. so if you want a dynamic tracing prefix, set a callback with OSSL_trace_set_callback() instead. 💅
OSSL_trace_set_callback() — enables the given trace category by handing it the tracer callback cb with the associated data data, which gets simply passed straight through to cb every time it's called. the callback function is internally wrapped by a dedicated BIO object, the so-called callback trace channel. use this when you want to form the trace output into something suited to your application's needs, i.e. the situations where a prefix line and a suffix line just aren't enough. 🔥
mutual exclusivity alert — OSSL_trace_set_channel() and OSSL_trace_set_callback() are mutually exclusive. calling one of them will clear whatever was set by the previous call. it's giving "there can only be one." ⚔️
the off switch — calling OSSL_trace_set_channel() with NULL for channel, or OSSL_trace_set_callback() with NULL for cb, disables tracing for the given category. bye bestie. 👋

🦋 Trace callback 🦋

the tracer callback must return a size_t, which must be zero on error, and otherwise returns the number of bytes that were output. it receives a text buffer buf with cnt bytes of text, plus the category, a control number cmd, and the data that was passed to OSSL_trace_set_callback().

the possible control numbers are:

OSSL_TRACE_CTRL_BEGIN — the callback is called from OSSL_trace_begin(), which gives the callback the possibility to output a dynamic starting line, or set a prefix that should be output at the beginning of each line, or something other. main character entrance energy. 👑
OSSL_TRACE_CTRL_WRITE — this callback is called whenever data is written to the BIO by some regular BIO output routine. an arbitrary number of OSSL_TRACE_CTRL_WRITE callbacks can occur inside a group marked by a pair of OSSL_TRACE_CTRL_BEGIN and OSSL_TRACE_CTRL_END calls, but never outside such a group. know your lane. 🚧
OSSL_TRACE_CTRL_END — the callback is called from OSSL_trace_end(), which gives the callback the possibility to output a dynamic ending line, or reset the line prefix that was set with OSSL_TRACE_CTRL_BEGIN, or something other.

🌈 Trace categories 🌈

the trace categories are simple numbers, available through macros. here's the whole roster:

OSSL_TRACE_CATEGORY_TRACE — traces the OpenSSL trace API itself. more precisely, this will generate trace output any time a new trace hook is set.
OSSL_TRACE_CATEGORY_INIT — traces OpenSSL library initialization and cleanup. this one needs special care, fr fr: OpenSSL will do automatic cleanup after exit from main(), and any tracing output done during this cleanup will be lost if the tracing channel or callback were cleaned away prematurely. a suggestion is to make such cleanup part of a function that's registered very early with atexit(3). 💀
OSSL_TRACE_CATEGORY_TLS — traces the TLS/SSL protocol.
OSSL_TRACE_CATEGORY_TLS_CIPHER — traces the ciphers used by the TLS/SSL protocol.
OSSL_TRACE_CATEGORY_CONF — traces details about the provider configuration.
OSSL_TRACE_CATEGORY_PKCS5V2 — traces PKCS#5 v2 key generation.
OSSL_TRACE_CATEGORY_PKCS12_KEYGEN — traces PKCS#12 key generation.
OSSL_TRACE_CATEGORY_PKCS12_DECRYPT — traces PKCS#12 decryption.
OSSL_TRACE_CATEGORY_X509V3_POLICY — traces X509v3 policy processing. more precisely, this generates the complete policy tree at various point during evaluation.
OSSL_TRACE_CATEGORY_BN_CTX — traces BIGNUM context operations.
OSSL_TRACE_CATEGORY_CMP — traces CMP client and server activity.
OSSL_TRACE_CATEGORY_STORE — traces STORE operations.
OSSL_TRACE_CATEGORY_DECODER — traces decoder operations.
OSSL_TRACE_CATEGORY_ENCODER — traces encoder operations.
OSSL_TRACE_CATEGORY_REF_COUNT — traces decrementing certain ASN.1 structure references.
OSSL_TRACE_CATEGORY_HTTP — traces the HTTP client, such as message headers being sent and received.

there's also OSSL_TRACE_CATEGORY_ALL, which works as a fallback and can be used to get all trace output. 🎉

⚠️ but listen — note, however, that in this case all trace output will effectively be associated with the 'ALL' category, which is undesirable if the application intends to include the category name in the trace output. in that case it is better to register separate channels for each trace category instead. iykyk. 🧐

🎀 RETURN VALUES 🎀

OSSL_trace_set_channel(), OSSL_trace_set_prefix(), OSSL_trace_set_suffix(), and OSSL_trace_set_callback() return 1 on success, or 0 on failure. that's it. that's the whole story. 🍓

💖 EXAMPLES 💖

in all the examples below, the trace producing code is assumed to be the following:

int foo = 42;
const char bar[] = { 0,  1,  2,  3,  4,  5,  6,  7,
                     8,  9, 10, 11, 12, 13, 14, 15 };

OSSL_TRACE_BEGIN(TLS) {
    BIO_puts(trc_out, "foo: ");
    BIO_printf(trc_out, "%d\n", foo);
    BIO_dump(trc_out, bar, sizeof(bar));
} OSSL_TRACE_END(TLS);

⭐ Simple example ⭐

an example with just a channel and a constant prefix / suffix. lowkey the easiest route:

int main(int argc, char *argv[])
{
    BIO *err = BIO_new_fp(stderr, BIO_NOCLOSE | BIO_FP_TEXT);
    OSSL_trace_set_channel(OSSL_TRACE_CATEGORY_SSL, err);
    OSSL_trace_set_prefix(OSSL_TRACE_CATEGORY_SSL, "BEGIN TRACE[TLS]");
    OSSL_trace_set_suffix(OSSL_TRACE_CATEGORY_SSL, "END TRACE[TLS]");

    /* ... work ... */
}

when the trace producing code above is performed, this will be output on standard error:

BEGIN TRACE[TLS]
foo: 42
0000 - 00 01 02 03 04 05 06 07-08 09 0a 0b 0c 0d 0e 0f   ................
END TRACE[TLS]

ate that. no notes. 👑

🚀 Advanced example 🚀

this example uses the callback, and depends on pthreads functionality. we're going full main character:

static size_t cb(const char *buf, size_t cnt,
                int category, int cmd, void *vdata)
{
    BIO *bio = vdata;
    const char *label = NULL;

    switch (cmd) {
    case OSSL_TRACE_CTRL_BEGIN:
        label = "BEGIN";
        break;
    case OSSL_TRACE_CTRL_END:
        label = "END";
        break;
    }

    if (label != NULL) {
        union {
            pthread_t tid;
            unsigned long ltid;
        } tid;

        tid.tid = pthread_self();
        BIO_printf(bio, "%s TRACE[%s]:%lx\n",
                   label, OSSL_trace_get_category_name(category), tid.ltid);
    }
    return (size_t)BIO_puts(bio, buf);
}

int main(int argc, char *argv[])
{
    BIO *err = BIO_new_fp(stderr, BIO_NOCLOSE | BIO_FP_TEXT);
    OSSL_trace_set_callback(OSSL_TRACE_CATEGORY_SSL, cb, err);

    /* ... work ... */
}

the output is almost the same as for the simple example above. almost. 🫶

BEGIN TRACE[TLS]:7f9eb0193b80
foo: 42
0000 - 00 01 02 03 04 05 06 07-08 09 0a 0b 0c 0d 0e 0f   ................
END TRACE[TLS]:7f9eb0193b80

🧚 NOTES 🧚

🌸 Configure Tracing 🌸

by default, the OpenSSL library is built with tracing disabled. tragic, i know. so to use the tracing functionality documented here, it is therefore necessary to configure and build OpenSSL with the 'enable-trace' option. flip that switch, bestie. 🔧

when the library is built with tracing disabled, the macro OPENSSL_NO_TRACE is defined in <openssl/opensslconf.h> and all functions described here are inoperational, i.e. will do nothing. they're just standing there. menacingly. doing nothing. 💀

📜 HISTORY 📜

OSSL_trace_set_channel(), OSSL_trace_set_prefix(), OSSL_trace_set_suffix(), and OSSL_trace_set_callback() were all added in OpenSSL 3.0.

the OSSL_TRACE_CATEGORY_ENGINE_TABLE and OSSL_TRACE_CATEGORY_ENGINE_REF_COUNT tracing categories were removed in OpenSSL 4.0. for details please see ossl-guide-migration(7). they didn't make it, rip. 🪦

👑 COPYRIGHT 👑

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, bestie 💖 this was OSSL_TRACE_SET_CHANNEL(3SSL) — version 4.0.3, dated 2026-09-29, straight from the OpenSSL source distribution. now go build with enable-trace and go watch your library spill the tea. slay, periodt. 💅✨

📦 where this page comes from

ubuntu stonking: libssl-doc 4.0.3-1ubuntu1 · Apache-2.0
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-11-03: a language model's rewrite of the original, under its terms

OSSL_TRACE_SET_CHANNEL(3SSL)