CONFIG(5ssl) OpenSSL CONFIG(5ssl) (NAME) config - CONF OpenSSL (DESCRIPTION) () OpenSSL NCONF_load(3) . OpenSSL . (semantics) . fips_config(5) x509v3_config(5) . ASN.1 ASN1_generate_nconf(3) . (SYNTAX) . (whitespace) . () # . # . (Directives) : .include .pragma. OpenSSL . (assignment) . include : .include [=] pathname pathname . .include . pathname ".cnf" ".conf" . ( POSIX IO .) pathname . .include . pathname (pragma) abspath includedir . OPENSSL_CONF_INCLUDE . . : .pragma [=] abspath:value value false off . .include (value) true on . $ . $ . : .pragma [=] dollarid:value value false off "foo$bar" "foo" "bar" . value true on "foo$bar" . .pragma [=] includedir:value .include OPENSSL_CONF_INCLUDE pragma includedir . (Settings) (section) . () . - (underscore) . . default () . . . ENV . / (name/value) . : [ section ] name1 = This is value1 name2 = Another value ... [ newsection ] name1 = New value1 name3 = Value 3 name - . , ; _ . . . DN (Certificate DNs) . openssl-req(1) . : 1.OU = First OU 2.OU = Second OU value = . (variable expansion) . $var "${var}" . $section::name "${section::name}" . $ENV::name . . default . / ENV (propagate) . . ' " \ (escape ). \ value . \n \r \b \t . value (pathname) .include . OPENSSL (OPENSSL LIBRARY CONFIGURATION) (module) OpenSSL . FIPS . OpenSSL openssl_conf . . CONF_modules_load_file() . OpenSSL config_diagnostics . CONF_modules_load() . (production) . . . # config_diagnostics = 1 openssl_conf = openssl_init [openssl_init] oid_section = oids providers = providers alg_section = evp_properties ssl_conf = ssl_configuration engines = engines random = random [oids] ... oids ... [providers] ... ... [evp_properties] ... EVP ... [ssl_configuration] ... SSL/TLS ... [engines] ... engine ... [random] ... random ... . << >> openssl_conf ( openssl_init ) . . ASN.1 (ASN.1 Object Identifier Configuration) oid_section / OID . . OpenSSL OID . [oids] shortName = a very long OID name, 1.2.3.4 newoid1 = 1.2.3.4.1 some_other_oid = 1.2.3.5 example.cnf : OPENSSL_CONF=example.cnf openssl asn1parse -genstr OID:1.2.3.4.1 : 0:d=0 hl=2 l= 4 prim: OBJECT :newoid1 OID "newoid1" "1.2.3.4.1" . (Provider Configuration) providers (cryptographic provider) . / . . : identity . : [providers] foo = foo_provider [foo_provider] identity = my_fips_module module ( - shared library) . activate yes on true 1 . no off false 0 . . activate . = item soft_load (error stack) . 1 yes true on ( ) 0 no false off ( ) . . off . . . OSSL_PROVIDER-default(7) . () openssl . . EVP (EVP Configuration) alg_section EVP . : default_properties (property query string) EVP_set_default_properties() . fips_mode ( ) yes no . yes : default_properties = fips=yes no . . SSL (SSL Configuration) ssl_conf SSL/TLS . . : [ssl_configuration] server = server_tls_config client = client_tls_config system_default = tls_system_default [server_tls_config] ... SSL/TLS ... [client_tls_config] ... SSL/TLS ... system_default . SSL_CTX . TLS DTLS : [tls_system_default] MinProtocol = TLSv1.2 MinProtocol = DTLSv1.2 TLS SSL_CTX TLS DTLS DTLS . MaxProtocol . / SSL_CONF_cmd(3) SSL_CTX_config() SSL_config() . . : [server_tls_config] RSA.Certificate = server-rsa.pem ECDSA.Certificate = server-ecdsa.pem Engine (Engine Configuration) engines ENGINE . engine . engine engine . engine : engine_id engine . . : [engines] foo = foo_engine [foo_engine] engine_id = myfoo dynamic_path ENGINE . ctrl SO_PATH LIST_ADD 2 LOAD ENGINE . ctrl ctrl ENGINE . init ENGINE . 0 ENGINE 1 ENGINE . init ENGINE . default_algorithms ENGINE ENGINE_set_default_string() . ctrl ENGINE . EMPTY . : [engines] foo = foo_engine [foo_engine] dynamic_path = /some/path/fooengine.so some_ctrl = some_value default_algorithms = ALL other_ctrl = EMPTY (Random Configuration) random . random : random (random bit generator) . : [random] random = CTR-DRBG : CTR-DRBG HASH-DRBG HMAC-DRBG cipher CTR-DRBG (cipher) . . AES-256-CTR . digest HASH-DRBG HMAC-DRBG () . . properties (property query) . seed . SEED-SRC FIPS . FIPS callback . seed_properties . random_provider RAND_bytes(3) . "fips" . . (EXAMPLES) (escaping) . # . HOME = /temp configdir = $ENV::HOME/config [ section_one ] # any = " any variable name " other = A string that can \ cover several lines \ by including \\ characters message = Hello World\n [ section_two ] greeting = $section_one::message . tempfile TEMP TMP . TMP /tmp TEMP TMP . # . TMP = /tmp TEMP = $ENV::TMP # tmpfile = ${ENV::TEMP}/tmp.filename FIPS sample . sample = fips_config [fips_config] alg_section = evp_properties [evp_properties] default_properties = "fips=yes" (ENVIRONMENT) OPENSSL_CONF . set-user-ID set-group-ID . OPENSSL_ENGINES engines. set-user-ID set-group-ID . OPENSSL_MODULES OpenSSL (providers). set-user-ID set-group-ID . OPENSSL_CONF_INCLUDE .include. (BUGS) () \nnn . null null . (escaping) : \n . . (HISTORY) API NCONF_WIN32() Microsoft Windows . - (semi-colon) . OpenSSL 3.0 . (SEE ALSO) openssl-x509(1), openssl-req(1), openssl-ca(1), openssl-fipsinstall(1), ASN1_generate_nconf(3), EVP_set_default_properties(3), CONF_modules_load(3), CONF_modules_load_file(3), RAND_bytes(3), fips_config(5), and x509v3_config(5). (COPYRIGHT) - OpenSSL. . . (Apache License 2.0) . . LICENSE . 3.6.4 2026-08-25 CONFIG(5ssl)