SSL_CTX_SET_KEYLOG_CALLBACK(3SSL)

💖 SSL_CTX_set_keylog_callback, SSL_CTX_get_keylog_callback, SSL_CTX_keylog_cb_func — logging TLS key material 💖

okay bestie, gather round, because this is one of those OpenSSL pages that's secretly so simple and yet so important. It lives in the OpenSSL manual, section 3SSL, and it's giving "tiny API, huge debugging energy." ✨

---

🌸 NAME 🌸

SSL_CTX_set_keylog_callback, SSL_CTX_get_keylog_callback, SSL_CTX_keylog_cb_func — literally just: logging TLS key material. that's it, that's the whole vibe. 🫶

---

✨ SYNOPSIS ✨

no cap, here's the whole thing:

#include <openssl/ssl.h>

typedef void (*SSL_CTX_keylog_cb_func)(const SSL *ssl, const char *line);

void SSL_CTX_set_keylog_callback(SSL_CTX *ctx, SSL_CTX_keylog_cb_func cb);
SSL_CTX_keylog_cb_func SSL_CTX_get_keylog_callback(const SSL_CTX *ctx);

---

🦋 DESCRIPTION 🦋

so SSL_CTX_set_keylog_callback() sets the TLS key logging callback. like, you hand it a function pointer and OpenSSL is like "noted, bestie." 💅 this callback gets called whenever TLS key material is generated or received — the whole point being that your app can stash that keying material away for debugging purposes. it's the "let me see what's actually happening in this handshake" button. 👑

SSL_CTX_get_keylog_callback() does the reverse girlypop move: it retrieves the TLS key logging callback you set earlier. And if no callback has been set? It returns NULL. simple as. 🌈

waaait, important: when there is no key logging callback, or if SSL_CTX_set_keylog_callback is called with NULL as the value of cb, then no logging of key material will be done. so NULL is basically the off switch. 🔇

now the tea on how the callback actually gets called — it receives two items:

• the ssl object associated with the connection 🎀
• line, a string containing the key material, in the format used by NSS for its SSLKEYLOGFILE debugging output 👑

and if you wanna recreate that file? the key logging callback should log line, followed by a newline. 📝 also line will always be a NUL-terminated string, so you can breathe, it's fine, no surprise non-terminated chaos here. 😌

---

⭐ RETURN VALUES ⭐

SSL_CTX_get_keylog_callback() returns a pointer to SSL_CTX_keylog_cb_func, or NULL if the callback is not set. that's the whole return value section, short and iconic, we love a concise queen. 💜

---

🔥 SEE ALSO 🔥

• ssl(7)

---

👑 COPYRIGHT 👑

Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

okay and that's the whole page, bestie — this was OpenSSL 4.0.3, dated 2026-09-29, from the SSL_CTX_SET_KEYLOG_CALLBACK(3SSL) manual. go forth and log those keys (for debugging only, mwah 💋). 🌸💖✨