---
name: "libressl-SSL_get_client_random"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-SSL_get_client_random"
---

# libressl-SSL\_get\_client\_random(3)

get internal TLS handshake random values and master key

## NAME

**SSL\_get\_client\_random**, **SSL\_get\_server\_random**, **SSL\_SESSION\_get\_master\_key** – get internal TLS handshake random values and master key

## SYNOPSIS

SSL Library (libssl, -lssl) libcrypto

**#include \<openssl/ssl.h\>**

*size\_t*\

**SSL\_get\_client\_random**(*const SSL \*ssl*, *unsigned char \*out*, *size\_t outlen*);

*size\_t*\

**SSL\_get\_server\_random**(*const SSL \*ssl*, *unsigned char \*out*, *size\_t outlen*);

*size\_t*\

**SSL\_SESSION\_get\_master\_key**(*const SSL\_SESSION \*session*, *unsigned char \*out*, *size\_t outlen*);

## DESCRIPTION

**SSL\_get\_client\_random**() extracts the random value that was sent from the client to the server during the initial TLS handshake. It copies at most *outlen* bytes of this value into the buffer *out*. If *outlen* is zero, nothing is copied.

**SSL\_get\_server\_random**() behaves the same, but extracts the random value that was sent from the server to the client during the initial TLS handshake.

**SSL\_SESSION\_get\_master\_key**() behaves the same, but extracts the master secret used to guarantee the security of the TLS session. The security of the TLS session depends on keeping the master key secret: do not expose it, or any information about it, to anybody. To calculate another secret value that depends on the master secret, use SSL\_export\_keying\_material(3) instead.

All these functions expose internal values from the TLS handshake, for use in low-level protocols. Avoid using them unless implementing a feature that requires access to the internal protocol details.

Despite the names of **SSL\_get\_client\_random**() and **SSL\_get\_server\_random**(), they are not random number generators. Instead, they return the mostly-random values that were already generated and used in the TLS protocol.

In current versions of the TLS protocols, the length of client\_random and server\_random is always SSL3\_RANDOM\_SIZE bytes. Support for other *outlen* arguments is provided for the unlikely event that a future version or variant of TLS uses some other length.

Finally, though the client\_random and server\_random values are called “random”, many TLS implementations generate four bytes of those values based on their view of the current time.

## RETURN VALUES

If *outlen* is greater than 0, these functions return the number of bytes actually copied, which is less than or equal to *outlen*. If *outlen* is 0, these functions return the maximum number of bytes they would copy — that is, the length of the underlying field.

## SEE ALSO

[ssl(3)](/ssl/3.md), SSL\_export\_keying\_material(3), SSL\_SESSION\_get\_id(3), SSL\_SESSION\_get\_time(3), SSL\_SESSION\_new(3)

## HISTORY

These functions first appeared in OpenSSL 1.1.0 and have been available since OpenBSD 6.3.