SSL_NEW_DOMAIN(3SSL)

📦
version 4.0.3 · 6 versions
, in ubuntu stonking

💖 SSL_NEW_DOMAIN(3SSL) — the OpenSSL manual, but make it cute ✨

okay so bestie, you know how the OpenSSL squad maintains their own man pages? yeah. this one lives in the 3SSL manual section and it's all about QUIC event domains 🦋. SSL_new_domain, SSL_is_domain and SSL_get0_domain are the three functions here and honestly? they're iconic.

🌸 NAME 🌸

SSL_new_domain, SSL_is_domain, SSL_get0_domain — the SSL object interface for managing QUIC event domains, periodt 💅

✨ SYNOPSIS ✨

#include <openssl/ssl.h>

SSL *SSL_new_domain(SSL_CTX *ctx, uint64_t flags);

int SSL_is_domain(SSL *ssl);
SSL *SSL_get0_domain(SSL *ssl);

look at that. three functions, one header, zero drama ✨

🫶 DESCRIPTION 🫶

so, SSL_new_domain() makes you a brand-new QUIC event domain, and it represents it as an SSL object. the cute nickname for this is a QUIC domain SSL object — QDSO, iykyk 🎀. if you want the full lore on what a QUIC event domain even is, that's all in openssl-quic-concurrency(7).

now the flags argument on SSL_new_domain()? that's you handing over a set of domain flags, and here's the tea ☕: if your flags doesn't specify one of SSL_DOMAIN_FLAG_SINGLE_THREAD, SSL_DOMAIN_FLAG_MULTI_THREAD or SSL_DOMAIN_FLAG_THREAD_ASSISTED, then the domain flags configured on the SSL_CTX get inherited as the default, and any other flags you passed in flags get added onto that inherited set. otherwise (so: if you did name one of those three), the domain flags in flags are just used as-is. the deets on which domain flags exist and how to set them on an SSL_CTX are in SSL_CTX_set_domain_flags(3).

a QUIC domain SSL object gets managed exactly like any other SSL object — it can be refcounted and freed normally, no special treatment 👑. and it's the parent of a whole bunch of child objects, like QUIC listener SSL objects. once you've created a QUIC domain SSL object, you can create a listener under it with SSL_new_listener_from(3) 🌈.

SSL_is_domain() returns 1 if a SSL object is a QUIC domain SSL object.

SSL_get0_domain() gets you a pointer to the QUIC domain SSL object in a SSL object hierarchy (if there is one — that "(if any)" is doing work, bestie).

and this part is honestly kind of the rule of the house: all SSL objects in a QUIC event domain use the same domain flags, and the domain flags for a QUIC domain cannot be changed after construction. so no take-backsies 🙈.

💀 Supported Operations 💀

a QUIC domain SSL object literally exists to contain other QUIC SSL objects and to provide unified event handling. that's its whole personality. so it only supports this specific list of operations:

the basic workflow for a domain object goes like:

for the full listener situation, go read SSL_new_listener_from(3).

also, rn? domain SSL objects are only supported for QUIC usage via any QUIC SSL_METHOD. that's the vibe check and it passed ✅.

🔥 RETURN VALUES 🔥

  • SSL_new_domain() returns a new domain SSL object, or NULL on failure 😭
  • SSL_is_domain() returns 0 or 1, depending on the type of the SSL object you called it on
  • SSL_get0_domain() returns an SSL object pointer (which, yes, could literally be the same object you called it on) or NULL

👀 SEE ALSO 👀

SSL_new_listener_from(3) SSL_handle_events(3), SSL_CTX_set_domain_flags(3), openssl-quic-concurrency(7)

🌟 HISTORY 🌟

These functions were added in OpenSSL 3.5. new-ish, freshly iconic 🎀

Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, bestie 💜 this was SSL_NEW_DOMAIN(3SSL) from OpenSSL 4.0.3, dated 2026-09-29. slay, go build a QUIC domain 🦋✨

📦 where this page comes from