.\" -*- mode: troff; coding: utf-8 -*- .\" Automatically generated by Pod::Man v6.0.2 (Pod::Simple 3.48) .\" .\" Standard preamble: .\" ======================================================================== .de Sp \" Vertical space (when we can't use .PP) .if t .sp .5v .if n .sp .. .de Vb \" Begin verbatim text .ft CW .nf .ne \\$1 .. .de Ve \" End verbatim text .ft R .fi .. .\" \*(C` and \*(C' are quotes in nroff, nothing in troff, for use with C<>. .ie n \{\ . ds C` "" . ds C' "" 'br\} .el\{\ . ds C` . ds C' 'br\} .\" .\" Escape single quotes in literal strings from groff's Unicode transform. .ie \n(.g .ds Aq \(aq .el .ds Aq ' .\" .\" If the F register is >0, we'll generate index entries on stderr for .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index .\" entries marked with X<> in POD. Of course, you'll have to process the .\" output yourself in some meaningful fashion. .\" .\" Avoid warning from groff about undefined register 'F'. .de IX .. .nr rF 0 .if \n(.g .if rF .nr rF 1 .if (\n(rF:(\n(.g==0)) \{\ . if \nF \{\ . de IX . tm Index:\\$1\t\\n%\t"\\$2" .. . if !\nF==2 \{\ . nr % 0 . nr F 2 . \} . \} .\} .rr rF .\" .\" Required to disable full justification in groff 1.23.0. .if n .ds AD l .\" ======================================================================== .\" .IX Title "SSL_GET_SHARED_SIGALGS 3ossl" .TH SSL_GET_SHARED_SIGALGS 3ossl 2026-09-29 4.0.3 OpenSSL .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l .nh .SH NAME SSL_get0_shared_sigalg, SSL_get0_sigalg, SSL_get_shared_sigalgs, SSL_get_sigalgs \- get shared or peer signature algorithms .SH SYNOPSIS .IX Header "SYNOPSIS" .Vb 1 \& #include \& \& int SSL_get0_sigalg(SSL *s, int idx, unsigned int *codepoint, \& const char **name); \& \& int SSL_get0_shared_sigalg(SSL *s, int idx, unsigned int *codepoint, \& const char **name); \& \& int SSL_get_shared_sigalgs(SSL *s, int idx, \& int *psign, int *phash, int *psignhash, \& unsigned char *rsig, unsigned char *rhash); \& \& int SSL_get_sigalgs(SSL *s, int idx, \& int *psign, int *phash, int *psignhash, \& unsigned char *rsig, unsigned char *rhash); .Ve .SH DESCRIPTION .IX Header "DESCRIPTION" \&\fBSSL_get0_shared_sigalg()\fR returns the names and codepoints of signature algorithms shared with the peer in the SSL connection \fIs\fR. When \fIidx\fR is negative, the number of algorithms is returned, and the output parameters remain unmodified. Otherwise, when \fIidx\fR is nonnegative, it is the index of the shared signature algorithm to return starting from zero. The signature algorithm name is written to \fI*name\fR (if \fIname\fR) is not NULL). The name reported is the IANA registered name for that algorithm, and is expected to work verbatim if used in a \fBSignatureAlgorithms\fR configuration setting (see \fBSSL_CONF_cmd\fR\|(3)). The signature algorithm codepoint is written to \fI*codepoint\fR (if \fIcodepoint\fR is not NULL). This function is better suited for inspecting TLS 1.3 signature algorithms than the older \fBSSL_get_shared_sigalgs()\fR. .PP \&\fBSSL_get0_sigalg()\fR returns the names and codepoints of signature algorithms advertised by the peer in the SSL connection \fIs\fR. When \fIidx\fR is negative, the number of algorithms is returned, and the output parameters remain unmodified. Otherwise, when \fIidx\fR is nonnegative, it is the index of the peer signature algorithm to return starting from zero. For signature algorithms that are locally known, the name reported is the IANA registered name for that algorithm, and is expected to work verbatim if used in a \fBSignatureAlgorithms\fR configuration setting (see \fBSSL_CONF_cmd\fR\|(3)). The signature algorithm codepoint is written to \fI*codepoint\fR (if \fIcodepoint\fR is not NULL). If the signature algorithm is known, its name is written to \fI*name\fR (if \&\fIname\fR) is not NULL). This function is better suited for inspecting TLS 1.3 signature algorithms than the older \fBSSL_get_sigalgs()\fR. .PP \&\fBSSL_get_shared_sigalgs()\fR returns information about the supported signature algorithms shared with the peer in the SSL connection \fIs\fR. When \fIidx\fR is negative, the number of shared algorithms is returned, and the output parameters remain unmodified. Otherwise, when \fIidx\fR is nonnegative, it is the index of the shared signature algorithm to return starting from zero. The signature algorithm NID is written to \fI*psign\fR, the hash NID to \fI*phash\fR and the sign and hash NID to \fI*psignhash\fR. As of TLS 1.3 signature algorithms are not always a pairing of a separate public key algorithm and a digest algorithm, and so \fI*phash\fR and \fI*psignhash\fR may not always be meaningful. The raw \fBhash\fR and \fBsignature\fR bytes of the signature algorithm codepoint are written to \fI*rhash\fR and \fI*rsig\fR. For example, the \fBrsa_pkcs1_sha256\fR signature algorithm, with codepoint \fB0x0401\fR, gives \fB0x04\fR for \fI*rhash\fR and \fB0x01\fR for \fI*rsig\fR. .PP \&\fBSSL_get_sigalgs()\fR is similar to \fBSSL_get_shared_sigalgs()\fR except it returns information about all signature algorithms advertised by the peer in the order they were sent by the peer. .SH "RETURN VALUES" .IX Header "RETURN VALUES" \&\fBSSL_get0_sigalg()\fR, \fBSSL_get0_shared_sigalg()\fR, \fBSSL_get_shared_sigalgs()\fR and \&\fBSSL_get_sigalgs()\fR return the number of signature algorithms or \fB0\fR if the \&\fIidx\fR parameter is out of range (too large). .SH NOTES .IX Header "NOTES" These functions are typically called for debugging purposes (to report the peer\*(Aqs preferences) or where an application wants finer control over certificate selection. Most applications will rely on internal handling and will not need to call them. .PP If an application is only interested in the highest preference shared signature algorithm it can just set \fBidx\fR to zero. .PP Any or all of the parameters \fBpsign\fR, \fBphash\fR, \fBpsignhash\fR, \fBrsig\fR or \&\fBrhash\fR can be set to NULL if the value is not required. By setting them all to NULL and setting \fBidx\fR to zero the total number of signature algorithms can be determined: which can be zero. .PP These functions must be called after the peer has sent a list of supported signature algorithms: after a client hello (for servers) or a certificate request (for clients). They can (for example) be called in the certificate callback. .PP Only TLS 1.2, TLS 1.3 and DTLS 1.2 currently support signature algorithms. If these functions are called on an earlier version of TLS or DTLS zero is returned. .PP The shared signature algorithms returned by \fBSSL_get_shared_sigalgs()\fR are ordered according to configuration and peer preferences. .PP The raw values correspond to the on the wire form as defined by RFC5246 et al. The NIDs are OpenSSL equivalents. For example if the peer sent \fBsha256\fR\|(4) and \&\fBrsa\fR\|(1) then \fB*rhash\fR would be 4, \fB*rsign\fR 1, \fB*phash\fR NID_sha256, \fB*psig\fR NID_rsaEncryption and \fB*psignhash\fR NID_sha256WithRSAEncryption. .PP If a signature algorithm is not recognised the corresponding NIDs will be set to \fBNID_undef\fR. This may be because the value is not supported, is not an appropriate combination (for example MD5 and DSA) or the signature algorithm does not use a hash (for example Ed25519). .SH "SEE ALSO" .IX Header "SEE ALSO" \&\fBSSL_CTX_set_cert_cb\fR\|(3), \&\fBssl\fR\|(7) .SH HISTORY .IX Header "HISTORY" Prior to OpenSSL 4.0 \fBSSL_get_shared_sigalgs()\fR treated negative \fIidx\fR values the same way as out\-of\-range (too large positive) values, and returned 0. .PP \&\fBSSL_get0_shared_sigalg()\fR and \fBSSL_get0_sigalg()\fR were added in OpenSSL 4.0. .SH COPYRIGHT .IX Header "COPYRIGHT" Copyright 2015\-2026 The OpenSSL Project Authors. All Rights Reserved. .PP Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at .