OPENSSL-GLOSSARY(7SSL)

📦

version 4.0.3 · 13 versions

👑 openssl-glossary — the OpenSSL vibe dictionary 💅

okay bestie, welcome to openssl-glossary, section 7SSL of the OpenSSL manual. this is the page where we define every word the OpenSSL girlies keep throwing around, so you can read the other pages and actually get it. no cap. grab a lil snack 🍓 and let's go ✨

🌈 DESCRIPTION 🌈

💖 Algorithm

crypto things like the SHA256 digest or AES encryption? in OpenSSL land we call those "algorithms". and here's the tea: there can be more than one implementation of any given algorithm available for you to use. iconic honestly.

🦋 ASN.1, ASN1

ASN.1, aka "Abstract Syntax Notation One" (yes the full name is giving very academic), is a notation for describing abstract types and values. it's defined in the ITU-T documents X.680 to X.683:

🎀 Base Provider

an OpenSSL Provider that holds encoders and decoders for OpenSSL keys. and here's the cute part: literally every algorithm implementation in the Base Provider is also available in the Default Provider. best of both worlds, she's generous like that 💅

✨ Decoder

a decoder is a type of algorithm used for decoding keys and parameters from some external format, like PEM or DER. she takes the outside-world format and brings it home 🫶

🌸 Default Provider

an OpenSSL Provider that contains the most common OpenSSL algorithm implementations. she gets loaded by default if no other provider is available — main character energy, fr. and all the algorithm implementations in the Base Provider are also available in the Default Provider.

💜 DER ("Distinguished Encoding Rules")

DER is a binary encoding of data, structured according to an ASN.1 specification. it's a super common encoding used for cryptographic objects like private and public keys, certificates, CRLs, ... the whole squad.

it's defined in ITU-T document X.690:

<https://www.itu.int/rec/T-REC-X.690>

⭐ Encoder

an encoder is a type of algorithm used for encoding keys and parameters to some external format such as PEM or DER. she's the one packing your stuff up for the outside world 📦

🔥 Explicit Fetching

Explicit Fetching is a type of Fetching (go read Fetching below, i'll wait 💖). Explicit Fetching is when you literally make a function call to obtain an algorithm object representing an implementation — like EVP_MD_fetch(3) or EVP_CIPHER_fetch(3). you asked, she delivered.

🧚 Fetching

Fetching is the whole process of looking through the available algorithm implementations, applying selection criteria (through a property query string), and finally choosing the implementation that will be used. it's giving shopping for the perfect fit ✨

also peep Explicit Fetching and Implicit Fetching.

💀 FIPS Provider

an OpenSSL Provider containing OpenSSL algorithm implementations that have been validated according to the FIPS 140-2 standard. she's certified, she has paperwork, she's that girl 📜

🙈 Implicit Fetching

Implicit Fetching is a type of Fetching (yep, again — see Fetching). Implicit Fetching is when an algorithm object with no associated implementation gets used — like the return value from EVP_sha256(3) or EVP_aes_128_cbc(3). with implicit fetching, an implementation gets fetched automatically using default selection criteria the first time the algorithm is used. she just shows up uninvited but honestly she's always welcome 🫶

🍓 Legacy Provider

an OpenSSL Provider that contains algorithm implementations considered insecure or no longer in common use. vintage, problematic, lowkey a red flag — but sometimes you still need her (and yes, "insecure" means insecure, so be careful with this one).

🦋 Library Context

a Library Context in OpenSSL is represented by the type OSSL_LIB_CTX. think of it as a scope within which configuration options apply. if an application doesn't explicitly create a library context, then the "default" one is used. lots of OpenSSL functions can take a library context as an argument, and you can always pass a NULL value to indicate the default library context. so chill, NULL is never a mistake here 💅

💜 MSBLOB

MSBLOB is a Microsoft specific binary format for RSA and DSA keys, both private and public. and heads up: this form is never passphrase protected. no password, no protection, that's just the rules 😭

🎀 Null Provider

an OpenSSL Provider that contains no algorithm implementations. which sounds useless but bestie it's actually useful: it can stop the default provider from being automatically loaded in a library context. the girl who does nothing and is still essential 👑

🌈 Operation

an operation is a group of OpenSSL functions with a common purpose, like encryption, or digesting. a whole friend group with one shared goal fr.

✨ PEM ("Privacy Enhanced Message")

PEM is a format used for encoding binary content into a mail-and-ASCII friendly form. the content is a series of base64-encoded lines, surrounded by begin/end markers, each on their own line. like this:

 -----BEGIN PRIVATE KEY-----
 MIICdg....
 ... bhTQ==
 -----END PRIVATE KEY-----

optional header line(s) may appear after the begin line, and whether they exist depends on the type of object being written or read.

for all OpenSSL uses, the binary content is expected to be a DER encoded structure.

this is defined in IETF RFC 1421:

<https://tools.ietf.org/html/rfc1421>

🌸 PKCS#8

PKCS#8 is a specification of ASN.1 structures that OpenSSL uses for storing or transmitting any private key in a key type agnostic manner. two structures are worth noting for OpenSSL use: one that contains the key data in unencrypted form (known as "PrivateKeyInfo") and an encrypted wrapper structure (known as "EncryptedPrivateKeyInfo"). key type agnostic means she does not care what kind of key you bring, she'll hold it 💖

this is specified in RFC 5208:

<https://tools.ietf.org/html/rfc5208>

⭐ Property

a property is a way of classifying and selecting algorithm implementations. a property is a key/value pair expressed as a string. for example, all algorithm implementations in the default provider have the property "provider=default". and an algorithm implementation can have multiple properties defined against it. she contains multitudes 💅

also peep Property Query String.

🔥 Property Query String

a property query string is a string containing a sequence of properties that can be used to select an algorithm implementation. for example, the query string "provider=example,foo=bar" will select algorithms from the "example" provider that have a "foo" property defined for them with a value of "bar". very specific, very picky, love that for her.

Property Query Strings are used during fetching. see Fetching.

🧚 Provider

a provider in OpenSSL is a component that groups together algorithm implementations. providers can come from OpenSSL itself or from third parties. so yeah, outside vendors are welcome to the party 🎉

💀 PVK

PVK is a Microsoft specific binary format for RSA and DSA private keys. this form may be passphrase protected. (unlike MSBLOB up there — see, we read the details 🫶)

🎀 SubjectPublicKeyInfo

SubjectPublicKeyInfo is an ASN.1 structure that OpenSSL uses for storing and transmitting any public key in a key type agnostic manner. public keys always welcome, no matter the type.

this is specified as part of the specification for certificates, RFC 5280:

<https://tools.ietf.org/html/rfc5280>

📜 HISTORY 📜

this glossary was added in OpenSSL 3.0. so if you're on something older, bestie... no glossary for you 😭

⚖️ COPYRIGHT ⚖️

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

real talk: that license paragraph is not a suggestion, it's the actual legal terms, so respect it 💖

and that's the whole glossary, bestie!! you made it to the end, ate and left no crumbs 👑✨ this was openssl-glossary(7SSL) from OpenSSL version 4.0.3, dated 2026-09-29 — go forth and flex your vocabulary, no cap 🦋💜

📦 where this page comes from

ubuntu stonking: openssl 4.0.3-1ubuntu1
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-11-03: a language model's rewrite of the original, under its terms