SSL_CTX_CONFIG(3SSL)

📦
version 4.0.3 · 13 versions
, in ubuntu stonking

✨ SSL_CTX_CONFIG — the manual page but make it a group chat ✨

okay bestie, this is SSL_CTX_CONFIG(3SSL) from the OpenSSL manuals, and it's literally the glow-up your config code has been begging for 💅

🌸 NAME 🌸

SSL_CTX_config, SSL_config — configure an SSL_CTX or an SSL structure. that's it, that's the job, and they ate 🔥

🎀 SYNOPSIS 🎀

#include <openssl/ssl.h>

int SSL_CTX_config(SSL_CTX *ctx, const char *name);
int SSL_config(SSL *s, const char *name);

look at those two little functions. so small. so powerful. iconic behavior fr fr ✨

🦋 DESCRIPTION 🦋

so here's the tea: SSL_CTX_config() and SSL_config() take an extra batch of configuration settings and slap them onto an SSL_CTX or an SSL structure, using the configuration name as the key. 🗝️

that name has to match a parameter over in the ssl module section of your configuration file. and the value of that parameter? it's the name of yet another section — one that's full of actual SSL configuration commands. it's sections all the way down, iykyk. if you wanna know exactly which commands are available, go read SSL_CONF_cmd(3). 📖

the way this slays is: by calling SSL_CTX_config() or SSL_config(), your app can do a whole bunch of complex tasks just by reading what's in the config file. like, greatly simplifying application configuration code. no cap. 🫶

and the future-proofing?? obsessed. the configuration section you point at can specify settings that the run-time version of OpenSSL supports — settings that literally did not exist as a concept back when your application code was written. your code from 2019 doesn't need to know about 2026's settings, the config file just handles it. main character energy. 👑

IMPORTANT THOUGH: a configuration file has to have been loaded before this, for example with CONF_modules_load_file(3). and if you want the full syntax deets, that's config(5). for most applications the default openssl.cnf file gets loaded automatically as part of library initialisation, so you probably don't even have to think about it. 🧚

⭐ RETURN VALUES ⭐

  • SSL_CTX_config() and SSL_config() return 1 for success ✨
  • or 0 if an error happened 💀

🌈 EXAMPLES 🌈

say your loaded configuration file looks like this:

# Top level "default" section, if no application name was specified as part
# initialisation, it defaults to "openssl_conf".
openssl_conf = openssl_init

[openssl_init]
# SSL module initialisation
ssl_conf = ssl_init

[ssl_init]
system_default = default_ssl_settings
tweaks_for_tls12 = tls12_custom_settings
tweaks_for_tls13 = tls13_custom_settings

[default_ssl_settings]
MinProtocol = TLSv1.2
# Defaults are typically the wisest choice, override only with good cause.
MinProtocol = ...
Ciphers = ...
Groups = ...
SignatureAlgorithms = ...

[tls12_custom_settings]
# Defaults are typically the wisest choice, override only with good cause.
MaxProtocol = TLSv1.2
...

[tls13_custom_settings]
# Defaults are typically the wisest choice, override only with good cause.
MinProtocol = TLSv1.3
...
notice how the comments keep saying defaults are typically the wisest choice and to override only with good cause. that's not filler, bestie, that's the universe gently holding your hand. 💖

so an application that wants to ONLY use "TLS 1.2" might call:

/* Initialised per "system_default" settings */
if ((ctx = SSL_CTX_new(TLS_server_method())) == NULL) {
    fprintf(stderr, "Error creating the SSL context.\n");
    goto err;
}

/*
 * Further tweaks per the "ssl" module "tweaks_for_tls12" setting, i.e. the
 * configuration file's "tls12_custom_settings" section.
 */
if (SSL_CTX_config(ctx, "tweaks_for_tls12") == 0) {
    fprintf(stderr, "Error applying 'tweaks_for_tls12' context configuration.\n");
    goto err;
}

and that is the whole flex 💅 the protocol version ceiling and all the other TLS 1.2–relevant settings live in the configuration file — they do not need to be hard-coded in the application. hard-coding is giving 2014, we don't do that anymore. 🙈

and it scales! same energy: if you use "tweaks_for_tls13" as the configuration name, it applies the corresponding settings from the "tls13_custom_settings" section (per the SSL module "tweaks_for_tls13" parameter). one word, whole new vibe. 🦋

👑 SEE ALSO 👑

ssl(7), config(5), SSL_CONF_cmd(3), SSL_CTX_new(3), CONF_modules_load_file(3), OPENSSL_init_ssl(3)

go read those too, bestie, they're all in the same friend group. 🫶

🕰️ HISTORY 🕰️

SSL_CTX_config() and SSL_config() were added in OpenSSL 1.1.0. so they've been serving since way back. ⭐

Copyright 2015-2020 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

aaand that's the page 💖 this was OpenSSL 4.0.3, dated 2026-09-29, filed under SSL_CTX_CONFIG(3SSL). go forth and let the config file do the work, you absolute legend 🎀✨

📦 where this page comes from