SSL_CONF_CMD(3ssl) OpenSSL SSL_CONF_CMD(3ssl) SSL_CONF_cmd_value_type, SSL_CONF_cmd - #include int SSL_CONF_cmd(SSL_CONF_CTX *ctx, const char *option, const char *value); int SSL_CONF_cmd_value_type(SSL_CONF_CTX *ctx, const char *option); SSL_CONF_cmd() option value ctx. SSL_CTX SSL . SSL_CONF_cmd_value_type() option. option ( SSL_CONF_FLAG_CMDLINE) . : option . value. - . -bugs SSL_OP_ALL. -no_comp SSL/TLS SSL_OP_NO_COMPRESSION. OpenSSL 1.1.0 . -comp SSL/TLS SSL_OP_NO_COMPRESSION. OpenSSL 1.1.0. OpenSSL 1.1.0 . TLS 1 . OpenSSL 3.2.0 2 . SSL_CTX_set_security_level(3). -no_ticket SSL_OP_NO_TICKET. -serverpref (TLS 1.2) (TLS 1.3) . SSL_OP_SERVER_PREFERENCE. . -client_renegotiation . SSL_OP_ALLOW_CLIENT_RENEGOTIATION. . -legacy_renegotiation . SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION. -no_renegotiation (D)TLSv1.2 SSL_OP_NO_RENEGOTIATION. -no_resumption_on_reneg SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION. . -legacy_server_connect, -no_legacy_server_connect OpenSSL . SSL_OP_LEGACY_SERVER_CONNECT. -prioritize_chacha ChaCha ChaCha20 . AES ( ). SSL_OP_PRIORITIZE_CHACHA. . -serverpref. -allow_no_dhe_kex TLSv1.3 (ec)dhe . (forward secrecy) . -prefer_no_dhe_kex TLSv1.3 (ec)dhe (ec)dhe. -allow_no_dhe_kex. SSL_OP_PREFER_NO_DHE_KEX. . -strict . SSL_CERT_FLAG_TLS_STRICT. -sigalgs algs TLSv1.2 TLSv1.3. . . algs algorithm+hash signature_scheme. OpenSSL algorithm RSA DSA ECDSA hash OID SHA1 SHA224 SHA256 SHA384 SHA512. signature_scheme TLSv1.3 IETF ecdsa_secp256r1_sha256 ed25519 rsa_pss_pss_sha256. TLS-SIGALG. ( ) algorithm+hash . provider-base(7). . : PKCS#1 v1.5 ( RSA algorithm rsa_pkcs1_*) TLSv1.3 . -client_sigalgs algs TLSv1.2 TLSv1.3. algs signature_algorithms CertificateRequest. . . algs -sigalgs. -sigalgs . -groups groups . . . ( TLSv1.2 ) . groups . IANA TLS Supported Groups . OpenSSL . NIST ( P-256) OID OpenSSL ( prime256v1) . OpenSSL 3.5 . . key_share ClientHello TLSv1.3. IANA TLS 1.2 TLS 1.3 : $ openssl list -tls1_2 -tls-groups $ openssl list -tls1_3 -tls-groups TLS 1.3 TLS OpenSSL. OpenSSL 3.5 X25519MLKEM768 . . HISTORY . SSL_CTX_set1_groups_list(3). TLS 1.2 TLS 1.2 . -curves -groups. -named_curve ECDH . TLS 1.0 1.1 . auto . NIST ( P-256) OID OpenSSL ( prime256v1). TLS 1.0 1.1 "auto" . OpenSSL 3.5 . -tx_cert_comp TLSv1.3. -no_tx_cert_comp TLSv1.3 . -rx_cert_comp TLSv1.3. -no_rx_cert_comp TLSv1.3 . -comp -cipher TLSv1.2 ciphers. TLSv1.3 . : ciphers SSL SSL_CTX ctx. -ciphersuites 1.3ciphers TLSv1.3 . TLSv1.3 . TLSv1.2 . openssl-ciphers(1) . -min_protocol minprot, -max_protocol maxprot . SSLv3 TLSv1 TLSv1.1 TLSv1.2 TLSv1.3 TLS DTLSv1 DTLSv1.2 DTLS None . . TLS DTLS TLS DTLS. . -record_padding padding TLSv1.3. padding "number[,number]" () () . . TLSv1.3 . 0 1 . >1 <=16384. -debug_broken_protocol . -no_middlebox " " . SSL_CONF_cmd() OpenSSL. -cert file file . SSL_CTX_use_certificate_chain_file() SSL_CTX SSL_use_certificate_file() PEM SSL. . -key file file . . : -key SSL_CONF_FLAG_REQUIRE_PRIVATE. -dhparam file file DH . . -no_ssl3, -no_tls1, -no_tls1_1, -no_tls1_2, -no_tls1_3 SSLv3 TLSv1.0 TLSv1.1 TLSv1.2 TLSv1.3 SSL_OP_NO_SSLv3 SSL_OP_NO_TLSv1 SSL_OP_NO_TLSv1_1 SSL_OP_NO_TLSv1_2 SSL_OP_NO_TLSv1_3 . -min_protocol -max_protocol . -anti_replay -no_anti_replay . OpenSSL TLSv1.3 . . . TLSv1.3. OpenSSL . SSL_OP_NO_ANTI_REPLAY. option ( SSL_CONF_FLAG_FILE) . option signaturealgorithms SignatureAlgorithms. value . : ( ) option . CipherString TLSv1.2 value. TLSv1.3 . : value SSL SSL_CTX ctx. Ciphersuites TLSv1.3 value. TLSv1.3 . TLSv1.2 . openssl-ciphers(1) . Certificate . SSL_CTX_use_certificate_chain_file() SSL_CTX SSL_use_certificate_file() PEM SSL. . PrivateKey . . : _ SSL_CONF_FLAG_REQUIRE_PRIVATE. ChainCAFile, ChainCAPath, VerifyCAFile, VerifyCAPath . . RequestCAFile PEM. _ TLS 1.3 ( ClientHello CertificateRequest) TLS. ServerInfoFile " " SSL_CTX_use_serverinfo_file. DHParameters DH . . RecordPadding TLSv1.3. value "[]" () () . . TLSv1.3 . 0 1 . >1 <=16384. QUIC . SSL QUIC. SignatureAlgorithms TLSv1.2 TLSv1.3. . . value algorithm+hash signature_scheme. OpenSSL algorithm RSA DSA ECDSA hash OID SHA1 SHA224 SHA256 SHA384 SHA512. signature_scheme TLSv1.3 IANA ecdsa_secp256r1_sha256 ed25519 rsa_pss_pss_sha256. ( ) algorithm+hash . TLS_SIGALG. "CAPABILITIES" provider-base(7). . : PKCS#1 v1.5 ( RSA algorithm rsa_pkcs1_*) TLSv1.3 . ClientSignatureAlgorithms TLSv1.2 TLSv1.3. signature_algorithms CertificateRequest. . . value SignatureAlgorithms. SignatureAlgorithms . Groups . . . ( TLSv1.2 ) . key_share TLSv1.3 ClientHello. groups . IANA TLS Supported Groups . OpenSSL . NIST ( P-256) OID OpenSSL ( prime256v1) . OpenSSL 3.5 . . TLS 1.2 TLS 1.3 : $ openssl list -tls1_2 -tls-groups $ openssl list -tls1_3 -tls-groups SSL_CTX_set1_groups_list(3). TLS 1.2 TLS 1.2 . Curves "Groups". MinProtocol SSL TLS DTLS . SSLv3 TLSv1 TLSv1.1 TLSv1.2 TLSv1.3 DTLSv1 DTLSv1.2. SSL TLS TLS DTLS DTLS. TLS DTLS. None . MaxProtocol SSL TLS DTLS. SSLv3 TLSv1 TLSv1.1 TLSv1.2 TLSv1.3 DTLSv1 DTLSv1.2. SSL TLS TLS DTLS DTLS. TLS DTLS. None . SSL TLS DTLS. value . - . . . . SSLv3 TLSv1 TLSv1.1 TLSv1.2 TLSv1.3 DTLSv1 DTLSv1.2. ALL . MinProtocol MaxProtocol . Protocol . MinProtocol MaxProtocol . Protocol "" TLS 1.0 TLS 1.2 TLS 1.1 . Options value . - . SSL_CTX_set_options(3) . . -flag . SessionTicket: . SSL_OP_NO_TICKET: -SessionTicket SSL_OP_NO_TICKET. Compression: SSL/TLS . SSL_OP_NO_COMPRESSION. EmptyFragments: SSL 3.0/TLS 1.0 CBC. . SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS. Bugs: . SSL_OP_ALL. DHSingle: DH . SSL_OP_DH_SINGLE. . ECDHSingle: ECDH . SSL_OP_ECDH_SINGLE. . ServerPreference: (TLS 1.2) (TLS 1.3) . SSL_OP_SERVER_PREFERENCE. . PrioritizeChaCha: ChaCha ChaCha20 . . SSL_OP_PRIORITIZE_CHACHA. . NoResumptionOnRenegotiation: SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION. . NoRenegotiation: TLSv1.2 SSL_OP_NO_RENEGOTIATION. UnsafeLegacyRenegotiation: . SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION. UnsafeLegacyServerConnect: OpenSSL . SSL_OP_LEGACY_SERVER_CONNECT. EncryptThenMac: MAC . SSL_OP_NO_ENCRYPT_THEN_MAC: -EncryptThenMac SSL_OP_NO_ENCRYPT_THEN_MAC. AllowNoDHEKEX: TLSv1.3 (ec)dhe . . SSL_OP_ALLOW_NO_DHE_KEX. PreferNoDHEKEX: TLSv1.3 (ec)dhe (ec)dhe. AllowNoDHEKEX. SSL_OP_PREFER_NO_DHE_KEX. . MiddleboxCompat: (CCS) TLSv1.3. TLSv1.3 TLSv1.2 TLSv1.3 . . OpenSSL . SSL_OP_ENABLE_MIDDLEBOX_COMPAT. AntiReplay: OpenSSL TLSv1.3 . . . TLSv1.3. OpenSSL . SSL_OP_NO_ANTI_REPLAY. ExtendedMasterSecret: . SSL_OP_NO_EXTENDED_MASTER_SECRET: -ExtendedMasterSecret SSL_OP_NO_EXTENDED_MASTER_SECRET. CANames: (CA) . SSL_OP_DISABLE_TLSEXT_CA_NAMES: -CANames SSL_OP_DISABLE_TLSEXT_CA_NAMES. KTLS: TLS . SSL_OP_ENABLE_KTLS. StrictCertCheck: . SSL_CERT_FLAG_TLS_STRICT SSL_CTX_set_cert_flags(). TxCertificateCompression: . SSL_OP_NO_TX_CERTIFICATE_COMPRESSION: -TxCertificateCompression SSL_OP_NO_TX_CERTIFICATE_COMPRESSION. RxCertificateCompression: . SSL_OP_NO_RX_CERTIFICATE_COMPRESSION: -RxCertificateCompression SSL_OP_NO_RX_CERTIFICATE_COMPRESSION. KTLSTxZerocopySendfile: (zerocopy) sendfile() KTLS. TLS . KTLS. SSL_OP_ENABLE_KTLS_TX_ZEROCOPY_SENDFILE. Linux. KTLS sendfile FreeBSD . IgnoreUnexpectedEOF: SSL_OP_IGNORE_UNEXPECTED_EOF. TLS . VerifyMode value . Peer : . Request . . Require : . . Once : . . RequestPostHandshake . . . . TLSv1.3 . RequiresPostHandshake : . . . . TLSv1.3 . ClientCAFile, ClientCAPath PEM . . . SSL_CONF_cmd_value_type() : SSL_CONF_TYPE_UNKNOWN option . SSL_CONF_TYPE_STRING . SSL_CONF_TYPE_FILE . SSL_CONF_TYPE_DIR . SSL_CONF_TYPE_NONE . . . : SSL_CONF_cmd(ctx, "Protocol", "-SSLv3"); SSL_CONF_cmd(ctx, userparam, uservalue); SSLv3 . : SSL_CONF_cmd(ctx, userparam, uservalue); SSL_CONF_cmd(ctx, "Protocol", "-SSLv3"); SSLv3 . SSL_CONF_cmd() option SSL_CONF_cmd() . SSL_CONF_cmd() -2 ( ) . SSL_CONF_cmd() SSL_CONF_cmd_argv() . SSL_CONF_CTX_set1_prefix() option value ( NULL). SSL_CONF_cmd(). -2 option . -3 . 0 . SSL_CONF_cmd_value_type() . SSL_CONF_TYPE_FILE . SSL_CONF_cmd() 1 option value 2 option value. . . -2 option . -3 option value NULL. 0 option value : value . : SSL_CONF_cmd(ctx, "SignatureAlgorithms", "ECDSA+SHA256:RSA+SHA256:DSA+SHA256"); . TLSv1 SSLv3. . SSL_CONF_cmd(ctx, "MinProtocol", "TLSv1"); SSLv3 : SSL_CONF_cmd(ctx, "Protocol", "-SSLv3"); SSLv3. "-SSLv3" SSLv3. SSL_CONF_cmd(ctx, "Protocol", "ALL,-SSLv3"); TLSv1.2 : SSL_CONF_cmd(ctx, "MinProtocol", "TLSv1.2"); SSL_CONF_cmd(ctx, "MaxProtocol", "TLSv1.2"); TLSv1.2 : SSL_CONF_cmd(ctx, "Protocol", "-ALL,TLSv1.2"); TLS: SSL_CONF_cmd(ctx, "Options", "-SessionTicket"); : SSL_CONF_cmd(ctx, "Options", "Compression"); P-256 P-384: SSL_CONF_cmd(ctx, "Curves", "P-256:P-384"); ssl(7), SSL_CONF_CTX_new(3), SSL_CONF_CTX_set_flags(3), SSL_CONF_CTX_set1_prefix(3), SSL_CONF_CTX_set_ssl_ctx(3), SSL_CONF_cmd_argv(3), SSL_CTX_set_options(3) SSL_CONF_cmd() OpenSSL 1.0.2. SSL_OP_NO_SSL2 1.1.0 . SSL_CONF_TYPE_NONE OpenSSL 1.1.0. OpenSSL SSL_CONF_TYPE_UNKNOWN. MinProtocol MaxProtocol OpenSSL 1.1.0. AllowNoDHEKEX PrioritizeChaCha OpenSSL 1.1.1. UnsafeLegacyServerConnect OpenSSL 3.0. TxCertificateCompression RxCertificateCompression OpenSSL 3.2. PreferNoDHEKEX OpenSSL 3.3. OpenSSL 3.5 TLS (PQ) TLS MLKEM512 MLKEM768 MLKEM1024. ML-KEM-512 ML-KEM-768 ML-KEM-1024 FIPS 203. OpenSSL 3.5 TLS ECDH PQ: X25519MLKEM768 SecP256r1MLKEM768 SecP384r1MLKEM1024. (CPU) ECDH . SecP384r1MLKEM1024 ECDH P-384. 1700 1200 . OpenSSL 3.5 . 2012-2026 OpenSSL. . Apache 2.0 ( ""). . LICENSE . 3 . . : . 3.6.2 7 2026 SSL_CONF_CMD(3ssl)