---
name: "libressl-SSL_CTX_set_client_CA_list"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-SSL_CTX_set_client_CA_list"
---

# libressl-SSL\_CTX\_set\_client\_CA\_list(3)

set list of CAs sent to the client when requesting a client certificate

## NAME

**SSL\_CTX\_set\_client\_CA\_list**, **SSL\_set\_client\_CA\_list**, **SSL\_CTX\_add\_client\_CA**, **SSL\_add\_client\_CA** – set list of CAs sent to the client when requesting a client certificate

## SYNOPSIS

SSL Library (libssl, -lssl) libcrypto

**#include \<openssl/ssl.h\>**

*void*\

**SSL\_CTX\_set\_client\_CA\_list**(*SSL\_CTX \*ctx*, *STACK\_OF(X509\_NAME) \*list*);

*void*\

**SSL\_set\_client\_CA\_list**(*SSL \*s*, *STACK\_OF(X509\_NAME) \*list*);

*int*\

**SSL\_CTX\_add\_client\_CA**(*SSL\_CTX \*ctx*, *X509 \*cacert*);

*int*\

**SSL\_add\_client\_CA**(*SSL \*ssl*, *X509 \*cacert*);

## DESCRIPTION

**SSL\_CTX\_set\_client\_CA\_list**() sets the *list* of CAs sent to the client when requesting a client certificate for *ctx*.

**SSL\_set\_client\_CA\_list**() sets the *list* of CAs sent to the client when requesting a client certificate for the chosen *ssl*, overriding the setting valid for *ssl*'s *SSL\_CTX* object.

**SSL\_CTX\_add\_client\_CA**() adds the CA name extracted from *cacert* to the list of CAs sent to the client when requesting a client certificate for *ctx*.

**SSL\_add\_client\_CA**() adds the CA name extracted from *cacert* to the list of CAs sent to the client when requesting a client certificate for the chosen *ssl*, overriding the setting valid for *ssl*'s *SSL\_CTX* object.

When a TLS/SSL server requests a client certificate (see **SSL\_CTX\_set\_verify**()), it sends a list of CAs for which it will accept certificates to the client.

This list must explicitly be set using **SSL\_CTX\_set\_client\_CA\_list**() for *ctx* and **SSL\_set\_client\_CA\_list**() for the specific *ssl*. The list specified overrides the previous setting. The CAs listed do not become trusted( *list* only contains the names, not the complete certificates); use SSL\_CTX\_load\_verify\_locations(3) to additionally load them for verification.

If the list of acceptable CAs is compiled in a file, the SSL\_load\_client\_CA\_file(3) function can be used to help importing the necessary data.

**SSL\_CTX\_add\_client\_CA**() and **SSL\_add\_client\_CA**() can be used to add additional items the list of client CAs. If no list was specified before using **SSL\_CTX\_set\_client\_CA\_list**() or **SSL\_set\_client\_CA\_list**(), a new client CA list for *ctx* or *ssl* (as appropriate) is opened.

These functions are only useful for TLS/SSL servers.

## RETURN VALUES

**SSL\_CTX\_add\_client\_CA**() and **SSL\_add\_client\_CA**() have the following return values:

- 0

  A failure while manipulating theSTACK\_OF (*X509\_NAME*) object occurred or the *X509\_NAME* could not be extracted from *cacert*. Check the error stack to find out the reason.

- 1

  The operation succeeded.

## EXAMPLES

Scan all certificates in *CAfile* and list them as acceptable CAs:

```
SSL_CTX_set_client_CA_list(ctx, SSL_load_client_CA_file(CAfile));
```

## SEE ALSO

[ssl(3)](/ssl/3.md), SSL\_CTX\_load\_verify\_locations(3), SSL\_get\_client\_CA\_list(3), SSL\_load\_client\_CA\_file(3), X509\_NAME\_new(3)

## HISTORY

**SSL\_CTX\_set\_client\_CA\_list**(), **SSL\_set\_client\_CA\_list**(), **SSL\_CTX\_add\_client\_CA**(), and **SSL\_add\_client\_CA**() first appeared in SSLeay 0.8.0 and have been available since OpenBSD 2.4.