---
name: "libressl-SSL_CTX_set_mode"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-SSL_CTX_set_mode"
---

# libressl-SSL\_CTX\_set\_mode(3)

manipulate SSL engine mode

## NAME

**SSL\_CTX\_set\_mode**, **SSL\_set\_mode**, **SSL\_CTX\_clear\_mode**, **SSL\_clear\_mode**, **SSL\_CTX\_get\_mode**, **SSL\_get\_mode** – manipulate SSL engine mode

## SYNOPSIS

SSL Library (libssl, -lssl) libcrypto

**#include \<openssl/ssl.h\>**

*long*\

**SSL\_CTX\_set\_mode**(*SSL\_CTX \*ctx*, *long mode*);

*long*\

**SSL\_set\_mode**(*SSL \*ssl*, *long mode*);

*long*\

**SSL\_CTX\_clear\_mode**(*SSL\_CTX \*ctx*, *long mode*);

*long*\

**SSL\_clear\_mode**(*SSL \*ssl*, *long mode*);

*long*\

**SSL\_CTX\_get\_mode**(*SSL\_CTX \*ctx*);

*long*\

**SSL\_get\_mode**(*SSL \*ssl*);

## DESCRIPTION

**SSL\_CTX\_set\_mode**() and **SSL\_set\_mode**() enable the options contained in the bitmask *mode* for the *ctx* or *ssl* object, respectively. Options that were already enabled before the call are not disabled.

**SSL\_CTX\_clear\_mode**() and **SSL\_clear\_mode**() disable the options contained in the bitmask *mode* for the *ctx* or *ssl* object.

**SSL\_CTX\_get\_mode**() and **SSL\_get\_mode**() return a bitmask representing the options that are currently enabled for the *ctx* or *ssl* object.

The following options are available:

- SSL\_MODE\_ENABLE\_PARTIAL\_WRITE

  Allow **SSL\_write**(*...*, *n*) to return **r** with 0 \< r \< n (i.e., report success when just a single record has been written). When not set (the default), SSL\_write(3) will only report success once the complete chunk was written. Once SSL\_write(3) returns with **r**, **r** bytes have been successfully written and the next call to SSL\_write(3) must only send the **n** **−** **r** bytes left, imitating the behaviour of [write(2)](/write/2.md).

- SSL\_MODE\_ACCEPT\_MOVING\_WRITE\_BUFFER

  Make it possible to retry SSL\_write(3) with changed buffer location (the buffer contents must stay the same). This is not the default to avoid the misconception that non-blocking SSL\_write(3) behaves like non-blocking [write(2)](/write/2.md).

- SSL\_MODE\_AUTO\_RETRY

  Never bother the application with retries if the transport is blocking. If a renegotiation takes place during normal operation, a SSL\_read(3) or SSL\_write(3) would return with −1 and indicate the need to retry with SSL\_ERROR\_WANT\_READ. In a non-blocking environment applications must be prepared to handle incomplete read/write operations. In a blocking environment, applications are not always prepared to deal with read/write operations returning without success report. The flag SSL\_MODE\_AUTO\_RETRY will cause read/write operations to only return after the handshake and successful completion.

- SSL\_MODE\_RELEASE\_BUFFERS

  When we no longer need a read buffer or a write buffer for a given *SSL*, then release the memory we were using to hold it. Using this flag can save around 34k per idle SSL connection. This flag has no effect on SSL v2 connections, or on DTLS connections.

## RETURN VALUES

**SSL\_CTX\_set\_mode**(), **SSL\_set\_mode**(), **SSL\_CTX\_clear\_mode**(), and **SSL\_clear\_mode**() return the new mode bitmask after adding or clearing *mode*.

**SSL\_CTX\_get\_mode**() and **SSL\_get\_mode**() return the current bitmask.

## SEE ALSO

[ssl(3)](/ssl/3.md), SSL\_CTX\_ctrl(3), SSL\_read(3), SSL\_write(3)

## HISTORY

**SSL\_CTX\_set\_mode**(), **SSL\_set\_mode**(), **SSL\_CTX\_get\_mode**(), and **SSL\_get\_mode**() first appeared in OpenSSL 0.9.4 and have been available since OpenBSD 2.6.

**SSL\_CTX\_clear\_mode**() and **SSL\_clear\_mode**() first appeared in OpenSSL 0.9.8m and have been available since OpenBSD 4.9.

SSL\_MODE\_AUTO\_RETRY was added in OpenSSL 0.9.6.