OPENSSL-ENV(7SSL)

📦
version 4.0.3 · 13 versions
, in ubuntu stonking

🎀 NAME 🎀

openssl-env — OpenSSL environment variables 💖 aka the little levers you can pull from your shell to make OpenSSL do what you want. (This page is 7SSL, bestie, so you know it's manual section 7.)

✨ DESCRIPTION ✨

okay so here's the vibe 🌈: the OpenSSL libraries and commands read environment variables to override compiled-in defaults for like, a whole bunch of their behaviour. Cute, right? 💅

but 🚨 listen — to avoid security risks, the environment is not consulted for security-sensitive environment variables when the executable is set-user-ID or set-group-ID. Setuid binaries basically said "not today, bestie" 🙈

Every variable below gets its own lil security vibe check too, so you always know where you stand 🫶

🔒 CTLOG_FILE

Tells OpenSSL where the certificate transparency log list lives — it's the path to that file. See CTLOG_STORE_new(3).

🚨 This one is a security-sensitive environment variable. Handle with care, queen.

🏠 HOME, SYSTEMROOT, USERPROFILE

This is the path that RAND_file_name(3) uses as the directory for the random seed file name — but only when the RANDFILE environment variable is not set. Important deets:

  • on Unix-like systems, HOME is the only one of these that even gets looked at;
  • on Windows platforms, USERPROFILE and SYSTEMROOT are used as fallbacks.
🚨 HOME is a security-sensitive environment variable. The others in this trio get a pass, but HOME? No ma'am.

🌐 HTTPS_PROXY, HTTP_PROXY, NO_PROXY, https_proxy, http_proxy, no_proxy

Specifies a proxy hostname. That's it, that's the job ✨ See OSSL_HTTP_parse_url(3).

🚨 All of these are security-sensitive environment variables.

🪆 LEGACY_GOST_PKCS12

Changes the way the MAC is generated inside PKCS#12 containers for GOST algorithms. See PKCS12_gen_mac(3).

🚨 Security-sensitive environment variable, bestie.

🧚 OPENSSL

The path to the openssl executable 👑. It's used by the rehash script (see "Script Configuration" in openssl-rehash(1)) and by the CA.pl script (see "NOTES" in CA.pl(1)).

🫶 This variable is not considered security-sensitive.

📄 OPENSSL_CONF, OPENSSL_CONF_INCLUDE

Specifies the path to a configuration file, plus the directory for included files. See config(5).

🚨 Both of these are security-sensitive environment variables.

⚙️ OPENSSL_CONFIG

Specifies a configuration option and filename for the req and ca commands when they're invoked by the CA.pl script. See CA.pl(1).

🫶 This variable is not considered security-sensitive.

🖥️ OPENSSL_DEBUG_DECC_INIT

On VMS only: if this variable is set, it enables verbose output of parsing of "DECC$*" logical names — those are the ones that contain C RTL features — during library initialisation ("LIB$INITIALIZE"). And if the value of the variable is more than 1, it outputs information about every processed feature. Very extra, we love that 🌸

🫶 This variable is not considered security-sensitive.

🧠 OPENSSL_MALLOC_FAILURES, OPENSSL_MALLOC_FD, OPENSSL_MALLOC_SEED

If OpenSSL was built with debugging, this trio lets memory allocation fail on purpose. See OPENSSL_malloc(3).

🫶 These variables are not considered security-sensitive.

📦 OPENSSL_MODULES

Specifies the directory that cryptographic providers get loaded from. Equivalently, you can use the generic -provider-path command-line option instead — same energy, different door 🚪

🚨 This variable is a security-sensitive environment variable.

🧪 OPENSSL_RUNNING_UNIT_TESTS

This one is used to flag the fact that unit tests are being run (i.e. make test). It's how OpenSSL detects when it should behave in a special manner during unit tests (i.e. when unit tests are being run on fuzzing builds). It should generally not be set by users, so hands off unless you know why you're here 🙈

This variable is available only when OpenSSL is built with -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION.

🫶 This variable is not considered security-sensitive.

🔐 OPENSSL_SEC_MEM

Initializes the secure memory at the beginning of the application, which makes the secure memory calls not fall back to regular memory calls 💪 The value indicates the size parameter in bytes. The value can be expressed in binary, octal, decimal and hexadecimal. For formatting see strtol(3). For further restrictions see CRYPTO_secure_malloc_init(3).

🫶 This variable is not considered security-sensitive.

📏 OPENSSL_SEC_MEM_MINSIZE

An optional variable used together with OPENSSL_SEC_MEM. The value indicates the minsize parameter in bytes. Same formatting applies as above. The default is 0. For more info see CRYPTO_secure_malloc_init(3).

🫶 This variable is not considered security-sensitive.

🧫 OPENSSL_TEST_LIBCTX

This test-only environment variable, which is recognised by the openssl(1) command, when set to "1", leads to the creation of a nondefault library context by the command — and for that context, the -config option then takes effect 👀

🫶 This variable is not considered security-sensitive.

🔍 OPENSSL_TRACE

By default the OpenSSL trace feature is disabled statically. To enable it, OpenSSL must be built with tracing support, which you can configure like this:

./config enable-trace

Unless OpenSSL tracing support is generally disabled, you can enable trace output of specific parts of the OpenSSL libraries, by name. Real talk though: this output usually makes sense only if you know OpenSSL internals well 🧠

The value of this environment variable is a comma-separated list of names, and here's every available one:

  • ALL — Traces everything. All of it. The whole buffet 🍓
  • BN_CTX — Traces BIGNUM context operations.
  • CMP — Traces CMP client and server activity.
  • CONF — Show details about provider configuration.
  • DECODER — Traces decoder operations.
  • ENCODER — Traces encoder operations.
  • HTTP — Traces the HTTP client and server, such as messages being sent and received.
  • INIT — Traces OpenSSL library initialization and cleanup.
  • PKCS12_DECRYPT — Traces PKCS#12 decryption.
  • PKCS12_KEYGEN — Traces PKCS#12 key generation.
  • PKCS5V2 — Traces PKCS#5 v2 key generation.
  • PROVIDER — Traces various operations that are performed on OpenSSL providers during their handling by the library (see provider(7)), such as initialisation, tear down, parameter and capability retrieval, self-test, and so on.
  • QUERY — Traces operations related to addition, removal, and fetching of methods in the so-called method store, that holds pointers to functions provided by various providers.
  • REF_COUNT — Traces reference count changes in various structures, including "BIO", "DH", "DSA", "EC_KEY", "ECX_KEY", "EVP_PKEY", "EVP_SKEY", "RSA", "SSL", "SSL_CTX", "SSL_SESSION", "X509_CRL", "X509_STORE", "X509", and some others.
  • STORE — Traces STORE operations.
  • TLS — Traces the TLS/SSL protocol.
  • TLS_CIPHER — Traces the ciphers used by the TLS/SSL protocol.
  • TRACE — Traces the OpenSSL trace API itself. Trace inception 🌀
  • X509V3_POLICY — Generates the complete policy tree at various points during X.509 v3 policy evaluation.
🫶 This variable is not considered security-sensitive.

🪟 OPENSSL_WIN32_UTF8

If set, then UI_OpenSSL(3) returns UTF-8 encoded strings, rather than ones encoded in the current code page, and the openssl(1) program also transcodes the command-line parameters from the current code page to UTF-8 🦋 Heads up: this environment variable is only checked on Microsoft Windows platforms.

🛡️ OPENSSL_armcap, OPENSSL_ia32cap, OPENSSL_ppccap, OPENSSL_riscvcap, OPENSSL_s390xcap, OPENSSL_sparcv9cap

OpenSSL supports a number of different algorithm implementations for various machines and, by default, it determines which to use based on the processor capabilities and run time feature enquiry 👑 These environment variables let you exert more control over that selection process. See OPENSSL_armcap(3), OPENSSL_ia32cap(3), OPENSSL_ppccap(3), OPENSSL_riscvcap(3) and OPENSSL_s390xcap(3).

🫶 These variables are not considered security-sensitive.

🌊 OSSL_QFILTER

Used to set a QUIC qlog filter specification. See openssl-qlog(7).

🚨 This variable is a security-sensitive environment variable.

📂 QLOGDIR

Specifies a QUIC qlog output directory. See openssl-qlog(7).

🚨 This variable is a security-sensitive environment variable.

🎲 RANDFILE

The state file for the random number generator. Real talk: this should not be needed in normal use. See RAND_load_file(3).

🚨 This variable is a security-sensitive environment variable.

🔑 SSLKEYLOGFILE

Used to produce the standard format output file for SSL key logging. Optionally set this variable to a filename to log all secrets produced by SSL connections 🔥 Note that use of this environment variable is predicated on configuring OpenSSL at build time with the enable-sslkeylog feature. The file format standard can be found at <https://datatracker.ietf.org/doc/draft-ietf-tls-keylogfile/>.

💀 Note: the use of SSLKEYLOGFILE poses an explicit security risk. By recording the exchanged keys during an SSL session, it allows any available party with read access to the file to decrypt application traffic sent over that session. Use of this feature should be restricted to test and debug environments only. No cap. Not the vibe for production 🙅
🚨 This variable is a security-sensitive environment variable.

📜 SSL_CERT_DIR, SSL_CERT_FILE

Specify the default directory or file containing CA certificates. SSL_CERT_DIR can contain multiple directories separated by colons (or semicolons on Windows). See SSL_CTX_load_verify_locations(3).

🚨 These variables are security-sensitive environment variables — except in openssl-rehash(1), where SSL_CERT_DIR is not considered security-sensitive. Special lil exception, we love a plot twist ✨

💐 SSL_CIPHER

Used by openssl-s_time(1) in case the -cipher option (that's the one that allows modifying the TLSv1.2 and below cipher list sent by the client) is not provided, for specification of the aforementioned ciphers.

🫶 This variable is not considered security-sensitive.

🐚 TSGET

Additional arguments for the tsget(1) command.

🫶 This variable is not considered security-sensitive.

💀 HISTORY 💀

okay bestie, gather round, this section is the graveyard 🪦 — these are environment variables that the OpenSSL libraries and commands do not consider anymore. They're retired. They served their time. We still document them so you're not sitting there like "why is my env doing nothing??" 🙈

🎀 HARNESS_OSSL_PREFIX 🎀

this one lived its little life in OpenSSL versions from 1.1.1 up to 3.5, and it let you specify a prefix that got prepended to every single line that openssl(1) sent to stdout 📝✨. Why tho? Because the test harness used it — it kept the output of the command under test from commingling (yes that's the word, it's giving fancier than "getting mixed up") with the output meant for the TAP consumer 🫶.

sadly it is no longer considered. rip bozo 😭

lowkey important note: this variable was not considered security-sensitive. So you can unclench 💅

🦋 OPENSSL_ENGINES 🦋

this one specified the directory that dynamic engines were loaded from 📂 — like, "hey, the engines live here". Support for it was removed in OpenSSL 4.0, so if you're still setting it, that's a ✨nostalgia act✨ and nothing more. it does absolutely nothing now, no cap 💀

Copyright 2019-2026 The OpenSSL Project Authors. All Rights Reserved. 🌸

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>. 💖

and that's the whole page bestie, we ate that fr fr 🍓✨ this was the OPENSSL-ENV(7SSL) page, from OpenSSL 4.0.3, dated 2026-09-29 — screenshot it, bookmark it, tattoo it, whichever vibe you're on 💅🦋 mwah, go forth and read your env vars 💜

📦 where this page comes from