---
name: "libressl-SSL_CTX_set_default_passwd_cb"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-SSL_CTX_set_default_passwd_cb"
---

# libressl-SSL\_CTX\_set\_default\_passwd\_cb(3)

set or get passwd callback for encrypted PEM file handling

## NAME

**SSL\_CTX\_set\_default\_passwd\_cb**, **SSL\_CTX\_set\_default\_passwd\_cb\_userdata**, **SSL\_CTX\_get\_default\_passwd\_cb**, **SSL\_CTX\_get\_default\_passwd\_cb\_userdata** – set or get passwd callback for encrypted PEM file handling

## SYNOPSIS

SSL Library (libssl, -lssl) libcrypto

**#include \<openssl/ssl.h\>**

*void*\

**SSL\_CTX\_set\_default\_passwd\_cb**(*SSL\_CTX \*ctx*, *pem\_password\_cb \*cb*);

*void*\

**SSL\_CTX\_set\_default\_passwd\_cb\_userdata**(*SSL\_CTX \*ctx*, *void \*userdata*);

*pem\_password\_cb* *\**\

**SSL\_CTX\_get\_default\_passwd\_cb**(*SSL\_CTX \*ctx*);

*void* *\**\

**SSL\_CTX\_get\_default\_passwd\_cb\_userdata**(*SSL\_CTX \*ctx*);

## DESCRIPTION

**SSL\_CTX\_set\_default\_passwd\_cb**() sets the password callback for loading a certificate or private key from encrypted PEM format. In particular, the callback is used by SSL\_CTX\_use\_certificate\_file(3), SSL\_use\_certificate\_file(3), SSL\_CTX\_use\_certificate\_chain\_file(3), SSL\_use\_certificate\_chain\_file(3), SSL\_CTX\_use\_certificate\_chain\_mem(3), SSL\_CTX\_use\_PrivateKey\_file(3), SSL\_use\_PrivateKey\_file(3), SSL\_CTX\_use\_RSAPrivateKey\_file(3), and SSL\_use\_RSAPrivateKey\_file(3).

The function pointer type of the *cb* argument is documented in the pem\_password\_cb(3) manual page. If **SSL\_CTX\_set\_default\_passwd\_cb**() is not called on *ctx* or if it is called with a *cb* argument of NULL, PEM\_def\_callback(3) is used instead.

**SSL\_CTX\_set\_default\_passwd\_cb\_userdata**() sets a pointer to the *userdata* which will be provided to the password callback on invocation.

Since the *cb* passed to **SSL\_CTX\_set\_default\_passwd\_cb**() will only be used for reading and decryption and not for writing and encryption, the library will only call it with a *verify* argument of 0.

If an application program only needs to read and decrypt one single private key, it can be practical to have the callback handle the password dialog interactively. This happens by default if neither **SSL\_CTX\_set\_default\_passwd\_cb**() nor **SSL\_CTX\_set\_default\_passwd\_cb\_userdata**() is called. In that case, the library uses PEM\_def\_callback(3) with a *userdata* argument of NULL.

If several keys have to be handled, it can be practical to ask for the password once, for example using UI\_UTIL\_read\_pw\_string(3), then keep it in memory and use it several times by passing a pointer to it to **SSL\_CTX\_set\_default\_passwd\_cb\_userdata**(). PEM\_def\_callback(3) is able to handle this case, too, so calling **SSL\_CTX\_set\_default\_passwd\_cb**() is not needed in this case either.

Other items in PEM formatting (certificates) can also be encrypted; it is however atypical, as certificate information is considered public.

## RETURN VALUES

**SSL\_CTX\_get\_default\_passwd\_cb**() returns a function pointer to the password callback currently set in *ctx*, or NULL if none is set.

**SSL\_CTX\_get\_default\_passwd\_cb\_userdata**() returns a pointer to the userdata currently set in *ctx*, or NULL if none is set.

## EXAMPLES

The following example provides a subset of the functionality of PEM\_def\_callback(3), except that PEM\_def\_callback(3) does not NUL-terminate and copies up to *size* rather than *size* - 1 bytes. It interprets *userdata* as a NUL-terminated string and copies it to the *password* buffer, truncating the copy if it does not fit.

```
int
trivial_passwd_cb(char *password, int size, int verify, void *userdata)
{
	strlcpy(password, userdata, size);
	return strlen(password);
}
```

## SEE ALSO

pem\_password\_cb(3), [ssl(3)](/ssl/3.md), SSL\_CTX\_use\_certificate(3)

## HISTORY

**SSL\_CTX\_set\_default\_passwd\_cb**() first appeared in SSLeay 0.6.2 and has been available since OpenBSD 2.4.

**SSL\_CTX\_set\_default\_passwd\_cb\_userdata**() first appeared in OpenSSL 0.9.4 and has been available since OpenBSD 2.6.

**SSL\_CTX\_get\_default\_passwd\_cb**() and **SSL\_CTX\_get\_default\_passwd\_cb\_userdata**() first appeared in OpenSSL 1.1.0 and have been available since OpenBSD 6.3.