(5ssl) OpenSSL (5ssl) config - OpenSSL CONF OpenSSL NCONF_load(3) . OpenSSL . . fips_config(5) x509v3_config(5). ASN.1 ASN1_generate_nconf(3). . . # . # . Directives : .include .pragma. OpenSSL . . : .include [=] pathname pathname . .include . pathname ".cnf" ".conf". ( / POSIX.) pathname. .include . pathname abspath includedir . OPENSSL_CONF_INCLUDE . . : .pragma [=] abspath:value value false off . .include value true on. $ . $ . : .pragma [=] dollarid:value value false off "foo$bar" "foo" "bar". value true on "foo$bar" . .pragma [=] includedir:value .include OPENSSL_CONF_INCLUDE includedir . . . . . . . . ENV. / . : [ section ] name1 = This is value1 name2 = Another value ... [ newsection ] name1 = New value1 name3 = Value 3 . , ; _. . . (DNs) . openssl-req(1) . : 1.OU = First OU 2.OU = Second OU = . . $var "${var}" . $section::name "${section::name}". $ENV::name . . . / ENV . 64 . ' " \ . \ . \n \r \b \t. .include. OPENSSL OpenSSL. FIPS . OpenSSL openssl_conf . . CONF_modules_load_file() . OpenSSL config_diagnostics. CONF_modules_load(). . . . # These must be in the default section config_diagnostics = 1 openssl_conf = openssl_init [openssl_init] oid_section = oids providers = providers alg_section = evp_properties ssl_conf = ssl_configuration engines = engines random = random [oids] ... new oids here ... [providers] ... provider stuff here ... [evp_properties] ... EVP properties here ... [ssl_configuration] ... SSL/TLS configuration properties here ... [engines] ... engine properties here ... [random] ... random properties here ... . " " openssl_conf ( openssl_init ). . ASN.1 oid_section / (OIDs). . OpenSSL . [oids] shortName = a very long OID name, 1.2.3.4 newoid1 = 1.2.3.4.1 some_other_oid = 1.2.3.5 example.cnf : OPENSSL_CONF=example.cnf openssl asn1parse -genstr OID:1.2.3.4.1 : 0:d=0 hl=2 l= 4 prim: OBJECT :newoid1 "newoid1" "1.2.3.4.1". providers section . / . . : identity . : [providers] foo = foo_provider [foo_provider] identity = my_fips_module module ( ) . activate yes on true 1 . no off false 0 . . activate . = item soft_load . 1 yes true on ( ) 0 no false off ( ) . . off . . OSSL_PROVIDER-default(7) . ( ) openssl. . EVP alg_section EVP. : default_properties EVP_set_default_properties(). fips_mode () yes no. yes : default_properties = fips=yes no . . SSL ssl_conf SSL/TLS. . : [ssl_configuration] server = server_tls_config client = client_tls_config system_default = tls_system_default [server_tls_config] ... configuration for SSL/TLS servers ... [client_tls_config] ... configuration for SSL/TLS clients ... system_default . SSL_CTX. TLS DTLS : [tls_system_default] MinProtocol = TLSv1.2 MinProtocol = DTLSv1.2 TLS SSL_CTX TLS DTLS DTLS. MaxProtocol. / SSL_CONF_cmd(3) SSL_CTX_config() SSL_config() . . : [server_tls_config] RSA.Certificate = server-rsa.pem ECDSA.Certificate = server-ecdsa.pem engines ENGINE. . . : engine_id . . : [engines] foo = foo_engine [foo_engine] engine_id = myfoo dynamic_path ENGINE . SO_PATH LIST_ADD 2 LOAD ENGINE . ENGINE . init ENGINE. 0 ENGINE 1 ENGINE . init ENGINE . default_algorithms ENGINE ENGINE_set_default_string(). ENGINE . EMPTY . : [engines] foo = foo_engine [foo_engine] dynamic_path = /some/path/fooengine.so some_ctrl = some_value default_algorithms = ALL other_ctrl = EMPTY random . : random . : [random] random = CTR-DRBG : CTR-DRBG HASH-DRBG HMAC-DRBG cipher CTR-DRBG. . AES-256-CTR. digest HASH-DRBG HMAC-DRBG. . properties . seed . SEED-SRC FIPS. FIPS . seed_properties . random_provider RAND_bytes(3) () . "fips". . . # This is the default section. HOME = /temp configdir = $ENV::HOME/config [ section_one ] # Quotes permit leading and trailing whitespace any = " any variable name " other = A string that can \ cover several lines \ by including \\ characters message = Hello World\n [ section_two ] greeting = $section_one::message . tempfile TEMP TMP . TMP /tmp TEMP TMP. # These two lines must be in the default section. TMP = /tmp TEMP = $ENV::TMP # This can be used anywhere tmpfile = ${ENV::TEMP}/tmp.filename FIPS sample. sample = fips_config [fips_config] alg_section = evp_properties [evp_properties] default_properties = "fips=yes" OPENSSL_CONF . set-user-ID set-group-ID. OPENSSL_ENGINES . set-user-ID set-group-ID. OPENSSL_MODULES OpenSSL . set-user-ID set-group-ID. OPENSSL_CONF_INCLUDE .include. \nnn. (null) . : \n . . NCONF_WIN32() . . OpenSSL 3.0 . openssl-x509(1) openssl-req(1) openssl-ca(1) openssl-fipsinstall(1) ASN1_generate_nconf(3) EVP_set_default_properties(3) CONF_modules_load(3) CONF_modules_load_file(3) RAND_bytes(3) fips_config(5) x509v3_config(5). 2000-2025 OpenSSL. . Apache 2.0 ( ""). . LICENSE . 3 . . : . 3.6.2 7 2026 (5ssl)