1*2175Sjp161948=pod 2*2175Sjp161948 3*2175Sjp161948=head1 NAME 4*2175Sjp161948 5*2175Sjp161948SSL_CTX_new - create a new SSL_CTX object as framework for TLS/SSL enabled functions 6*2175Sjp161948 7*2175Sjp161948=head1 SYNOPSIS 8*2175Sjp161948 9*2175Sjp161948 #include <openssl/ssl.h> 10*2175Sjp161948 11*2175Sjp161948 SSL_CTX *SSL_CTX_new(SSL_METHOD *method); 12*2175Sjp161948 13*2175Sjp161948=head1 DESCRIPTION 14*2175Sjp161948 15*2175Sjp161948SSL_CTX_new() creates a new B<SSL_CTX> object as framework to establish 16*2175Sjp161948TLS/SSL enabled connections. 17*2175Sjp161948 18*2175Sjp161948=head1 NOTES 19*2175Sjp161948 20*2175Sjp161948The SSL_CTX object uses B<method> as connection method. The methods exist 21*2175Sjp161948in a generic type (for client and server use), a server only type, and a 22*2175Sjp161948client only type. B<method> can be of the following types: 23*2175Sjp161948 24*2175Sjp161948=over 4 25*2175Sjp161948 26*2175Sjp161948=item SSLv2_method(void), SSLv2_server_method(void), SSLv2_client_method(void) 27*2175Sjp161948 28*2175Sjp161948A TLS/SSL connection established with these methods will only understand 29*2175Sjp161948the SSLv2 protocol. A client will send out SSLv2 client hello messages 30*2175Sjp161948and will also indicate that it only understand SSLv2. A server will only 31*2175Sjp161948understand SSLv2 client hello messages. 32*2175Sjp161948 33*2175Sjp161948=item SSLv3_method(void), SSLv3_server_method(void), SSLv3_client_method(void) 34*2175Sjp161948 35*2175Sjp161948A TLS/SSL connection established with these methods will only understand the 36*2175Sjp161948SSLv3 protocol. A client will send out SSLv3 client hello messages 37*2175Sjp161948and will indicate that it only understands SSLv3. A server will only understand 38*2175Sjp161948SSLv3 client hello messages. This especially means, that it will 39*2175Sjp161948not understand SSLv2 client hello messages which are widely used for 40*2175Sjp161948compatibility reasons, see SSLv23_*_method(). 41*2175Sjp161948 42*2175Sjp161948=item TLSv1_method(void), TLSv1_server_method(void), TLSv1_client_method(void) 43*2175Sjp161948 44*2175Sjp161948A TLS/SSL connection established with these methods will only understand the 45*2175Sjp161948TLSv1 protocol. A client will send out TLSv1 client hello messages 46*2175Sjp161948and will indicate that it only understands TLSv1. A server will only understand 47*2175Sjp161948TLSv1 client hello messages. This especially means, that it will 48*2175Sjp161948not understand SSLv2 client hello messages which are widely used for 49*2175Sjp161948compatibility reasons, see SSLv23_*_method(). It will also not understand 50*2175Sjp161948SSLv3 client hello messages. 51*2175Sjp161948 52*2175Sjp161948=item SSLv23_method(void), SSLv23_server_method(void), SSLv23_client_method(void) 53*2175Sjp161948 54*2175Sjp161948A TLS/SSL connection established with these methods will understand the SSLv2, 55*2175Sjp161948SSLv3, and TLSv1 protocol. A client will send out SSLv2 client hello messages 56*2175Sjp161948and will indicate that it also understands SSLv3 and TLSv1. A server will 57*2175Sjp161948understand SSLv2, SSLv3, and TLSv1 client hello messages. This is the best 58*2175Sjp161948choice when compatibility is a concern. 59*2175Sjp161948 60*2175Sjp161948=back 61*2175Sjp161948 62*2175Sjp161948The list of protocols available can later be limited using the SSL_OP_NO_SSLv2, 63*2175Sjp161948SSL_OP_NO_SSLv3, SSL_OP_NO_TLSv1 options of the B<SSL_CTX_set_options()> or 64*2175Sjp161948B<SSL_set_options()> functions. Using these options it is possible to choose 65*2175Sjp161948e.g. SSLv23_server_method() and be able to negotiate with all possible 66*2175Sjp161948clients, but to only allow newer protocols like SSLv3 or TLSv1. 67*2175Sjp161948 68*2175Sjp161948SSL_CTX_new() initializes the list of ciphers, the session cache setting, 69*2175Sjp161948the callbacks, the keys and certificates, and the options to its default 70*2175Sjp161948values. 71*2175Sjp161948 72*2175Sjp161948=head1 RETURN VALUES 73*2175Sjp161948 74*2175Sjp161948The following return values can occur: 75*2175Sjp161948 76*2175Sjp161948=over 4 77*2175Sjp161948 78*2175Sjp161948=item NULL 79*2175Sjp161948 80*2175Sjp161948The creation of a new SSL_CTX object failed. Check the error stack to 81*2175Sjp161948find out the reason. 82*2175Sjp161948 83*2175Sjp161948=item Pointer to an SSL_CTX object 84*2175Sjp161948 85*2175Sjp161948The return value points to an allocated SSL_CTX object. 86*2175Sjp161948 87*2175Sjp161948=back 88*2175Sjp161948 89*2175Sjp161948=head1 SEE ALSO 90*2175Sjp161948 91*2175Sjp161948L<SSL_CTX_free(3)|SSL_CTX_free(3)>, L<SSL_accept(3)|SSL_accept(3)>, 92*2175Sjp161948L<ssl(3)|ssl(3)>, L<SSL_set_connect_state(3)|SSL_set_connect_state(3)> 93*2175Sjp161948 94*2175Sjp161948=cut 95