NAME
SSL_CTX_set_min_proto_version,
SSL_CTX_set_max_proto_version,
SSL_CTX_get_min_proto_version,
SSL_CTX_get_max_proto_version,
SSL_set_min_proto_version,
SSL_set_max_proto_version,
SSL_get_min_proto_version,
SSL_get_max_proto_version —
get and set minimum and maximum
supported protocol version
SYNOPSIS
#include
<openssl/ssl.h>
int
SSL_CTX_set_min_proto_version(SSL_CTX
*ctx, uint16_t version);
int
SSL_CTX_set_max_proto_version(SSL_CTX
*ctx, uint16_t version);
int
SSL_CTX_get_min_proto_version(SSL_CTX
*ctx);
int
SSL_CTX_get_max_proto_version(SSL_CTX
*ctx);
int
SSL_set_min_proto_version(SSL
*ssl, uint16_t version);
int
SSL_set_max_proto_version(SSL
*ssl, uint16_t version);
int
SSL_get_min_proto_version(SSL
*ssl);
int
SSL_get_max_proto_version(SSL
*ssl);
DESCRIPTION
These functions get or set the minimum and maximum supported protocol versions for ctx or ssl. This works in combination with the options set via SSL_CTX_set_options(3) that also make it possible to disable specific protocol versions. Use these functions instead of disabling specific protocol versions.
Setting the minimum or maximum version to 0 will enable protocol versions down to the lowest or up to the highest version supported by the library, respectively.
Currently supported versions are
TLS1_VERSION,
TLS1_1_VERSION, and
TLS1_2_VERSION for TLS and
DTLS1_VERSION and
DTLS1_2_VERSION for DTLS.
In other implementations, these functions may be implemented as macros.
RETURN VALUES
The setter functions return 1 on success or 0 on failure.
The getter functions return the configured version or 0 if ctx or ssl has been configured to automatically use the lowest or highest version supported by the library.
SEE ALSO
HISTORY
The setter functions first appeared in BoringSSL in December 2014, with shorter names without the proto_ part. Two years later, OpenSSL included them in their 1.1.0 release, gratuitously changing the names; Google shrugged and adopted the longer names one month later. They have been available since OpenBSD 6.2.
The getter functions first appeared in OpenSSL 1.1.0g and have been available since OpenBSD 6.3.