SSL_CTX_SET_MIN_PROTO_VERSION(3SSL)

📦
version 4.0.3 · 14 versions
, in ubuntu stonking

💖 SSL_CTX_set_min_proto_version — the 3SSL girlies' edition 💖

okay bestie, gather round, because today we're talking about the protocol version gatekeeping functions from <openssl/ssl.h>, and honestly? they're iconic. 💅

✨ NAME ✨

Let me introduce the whole squad, no one gets left out:

  • SSL_CTX_set_min_proto_version
  • SSL_CTX_set_max_proto_version
  • SSL_CTX_get_min_proto_version
  • SSL_CTX_get_max_proto_version
  • SSL_set_min_proto_version
  • SSL_set_max_proto_version
  • SSL_get_min_proto_version
  • SSL_get_max_proto_version

and what do they do, you ask? Get and set minimum and maximum supported protocol version. that's it, that's the whole vibe. 🎀

🌸 SYNOPSIS 🌸

#include <openssl/ssl.h>

int SSL_CTX_set_min_proto_version(SSL_CTX *ctx, int version);
int SSL_CTX_set_max_proto_version(SSL_CTX *ctx, int version);
int SSL_CTX_get_min_proto_version(SSL_CTX *ctx);
int SSL_CTX_get_max_proto_version(SSL_CTX *ctx);

int SSL_set_min_proto_version(SSL *ssl, int version);
int SSL_set_max_proto_version(SSL *ssl, int version);
int SSL_get_min_proto_version(SSL *ssl);
int SSL_get_max_proto_version(SSL *ssl);

like yes, eight functions, four for the SSL_CTX *ctx girlies and four for the SSL *ssl girlies. balance. symmetry. ✨

🦋 DESCRIPTION 🦋

so basically, these functions get or set the minimum and maximum supported protocol versions for the ctx or the ssl. cute, right? and they work in combination with the options you set via SSL_CTX_set_options(3) — you know, the ones that also let you disable specific protocol versions.

but here's the tea, bestie, and I need you to hear me: use these functions instead of disabling specific protocol versions. that's literally the assignment. 🫶

now, setting the minimum or maximum version to 0 (which is the default, btw) will enable protocol versions down to the lowest version, or up to the highest version supported by the library, respectively. and lowkey the supported versions might be controlled by your system configuration, so like… it's giving "not entirely up to you". 🙈

the getters? they return 0 in case ctx or ssl have been configured to automatically use the lowest or highest version supported by the library. so 0 = "auto, we're just vibing, library decides". 💫

currently supported versions are:

  • SSL3_VERSION
  • TLS1_VERSION
  • TLS1_1_VERSION
  • TLS1_2_VERSION
  • TLS1_3_VERSION

…for TLS. and for DTLS:

  • DTLS1_VERSION
  • DTLS1_2_VERSION

and in the current version of OpenSSL, only QUICv1 is supported in conjunction with TLSv1.3. calling these functions on a QUIC object has no effect. not me finding out QUIC said "I don't take requests". 💀

⭐ RETURN VALUES ⭐

okay so the receipts:

  • the setter functions return 1 on success and 0 on failure. 💯
  • the getter functions return the configured version, or 0 for auto-configuration of lowest or highest protocol, respectively.

that's it. 1 slay, 0 no slay. 😭

🎀 NOTES 🎀

all these functions are implemented using macros. iykyk. ✨

🌈 SEE ALSO 🌈

go read these too, bestie, they're part of the friend group:

👑 HISTORY 👑

  • The setter functions were added in OpenSSL 1.1.0.
  • The getter functions were added in OpenSSL 1.1.1.

the getters really said "fashionably late but worth the wait". 💅

Copyright 2016-2025 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page, mwah. 💋 this was the OpenSSL 4.0.3 edition of the SSL_CTX_SET_MIN_PROTO_VERSION(3SSL) manual, dated 2026-09-2, and yes she ate. 🍓🧚💖 periodt.

📦 where this page comes from