---
name: "libressl-SSL_CTX_set_tlsext_use_srtp"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-SSL_CTX_set_tlsext_use_srtp"
---

# libressl-SSL\_CTX\_set\_tlsext\_use\_srtp(3)

Configure and query SRTP support

## NAME

**SSL\_CTX\_set\_tlsext\_use\_srtp**, **SSL\_set\_tlsext\_use\_srtp**, **SSL\_get\_srtp\_profiles**, **SSL\_get\_selected\_srtp\_profile** – Configure and query SRTP support

## SYNOPSIS

SSL Library (libssl, -lssl) libcrypto

**#include \<openssl/srtp.h\>**

*int*\

**SSL\_CTX\_set\_tlsext\_use\_srtp**(*SSL\_CTX \*ctx*, *const char \*profiles*);

*int*\

**SSL\_set\_tlsext\_use\_srtp**(*SSL \*ssl*, *const char \*profiles*);

*STACK\_OF(SRTP\_PROTECTION\_PROFILE)* *\**\

**SSL\_get\_srtp\_profiles**(*SSL \*ssl*);

*SRTP\_PROTECTION\_PROFILE* *\**\

**SSL\_get\_selected\_srtp\_profile**(*SSL \*ssl*);

## DESCRIPTION

SRTP is the Secure Real-Time Transport Protocol. OpenSSL implements support for the "use\_srtp" DTLS extension defined in RFC 5764. This provides a mechanism for establishing SRTP keying material, algorithms and parameters using DTLS. This capability may be used as part of an implementation that conforms to RFC 5763. OpenSSL does not implement SRTP itself or RFC 5763. Note that OpenSSL does not support the use of SRTP Master Key Identifiers (MKIs). Also note that this extension is only supported in DTLS. Any SRTP configuration is ignored if a TLS connection is attempted.

An OpenSSL client wishing to send the "use\_srtp" extension should call **SSL\_CTX\_set\_tlsext\_use\_srtp**() to set its use for all *SSL* objects subsequently created from *ctx*. Alternatively a client may call **SSL\_set\_tlsext\_use\_srtp**() to set its use for an individual *SSL* object. The *profiles* parameter should point to a NUL-terminated, colon delimited list of SRTP protection profile names.

The currently supported protection profile names are:

- SRTP\_AES128\_CM\_SHA1\_80

  This corresponds to SRTP\_AES128\_CM\_HMAC\_SHA1\_80 defined in RFC 5764.

- SRTP\_AES128\_CM\_SHA1\_32

  This corresponds to SRTP\_AES128\_CM\_HMAC\_SHA1\_32 defined in RFC 5764.

- SRTP\_AEAD\_AES\_128\_GCM

  This corresponds to SRTP\_AEAD\_AES\_128\_GCM defined in RFC 7714.

- SRTP\_AEAD\_AES\_256\_GCM

  This corresponds to SRTP\_AEAD\_AES\_256\_GCM defined in RFC 7714.

Supplying an unrecognised protection profile name results in an error.

An OpenSSL server wishing to support the "use\_srtp" extension should also call **SSL\_CTX\_set\_tlsext\_use\_srtp**() or **SSL\_set\_tlsext\_use\_srtp**() to indicate the protection profiles that it is willing to negotiate.

The currently configured list of protection profiles for either a client or a server can be obtained by calling **SSL\_get\_srtp\_profiles**(). This returns a stack of *SRTP\_PROTECTION\_PROFILE* objects. The memory pointed to in the return value of this function should not be freed by the caller.

After a handshake has been completed, the negotiated SRTP protection profile (if any) can be obtained (on the client or the server) by calling **SSL\_get\_selected\_srtp\_profile**(). This function returns NULL if no SRTP protection profile was negotiated. The memory returned from this function should not be freed by the caller.

If an SRTP protection profile has been successfully negotiated, then the SRTP keying material (on both the client and server) should be obtained by calling SSL\_export\_keying\_material(3) with a *label* of "EXTRACTOR-dtls\_srtp", a *context* of NULL, and a *use\_context* argument of 0. The total length of keying material obtained should be equal to two times the sum of the master key length and the salt length as defined for the protection profile in use. This provides the client write master key, the server write master key, the client write master salt and the server write master salt in that order.

## RETURN VALUES

Contrary to OpenSSL conventions, **SSL\_CTX\_set\_tlsext\_use\_srtp**() and **SSL\_set\_tlsext\_use\_srtp**() return 0 on success or 1 on error.

**SSL\_get\_srtp\_profiles**() returns a stack of *SRTP\_PROTECTION\_PROFILE* objects on success or NULL on error or if no protection profiles have been configured.

**SSL\_get\_selected\_srtp\_profile**() returns a pointer to an *SRTP\_PROTECTION\_PROFILE* object if one has been negotiated or NULL otherwise.

## SEE ALSO

[ssl(3)](/ssl/3.md), SSL\_export\_keying\_material(3)

## HISTORY

These functions first appeared in OpenSSL 1.0.1 and have been available since OpenBSD 5.3.