---
name: "libressl-SSL_get_error"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-SSL_get_error"
---

# libressl-SSL\_get\_error(3)

obtain result code for TLS/SSL I/O operation

## NAME

**SSL\_get\_error** – obtain result code for TLS/SSL I/O operation

## SYNOPSIS

SSL Library (libssl, -lssl) libcrypto

**#include \<openssl/ssl.h\>**

*int*\

**SSL\_get\_error**(*const SSL \*ssl*, *int ret*);

## DESCRIPTION

**SSL\_get\_error**() returns a result code (suitable for the C “switch” statement) for a preceding call to SSL\_connect(3), SSL\_accept(3), SSL\_do\_handshake(3), SSL\_read(3), SSL\_peek(3), or SSL\_write(3) on *ssl*. The value returned by that TLS/SSL I/O function must be passed to **SSL\_get\_error**() in parameter *ret*.

In addition to *ssl* and *ret*, **SSL\_get\_error**() inspects the current thread's OpenSSL error queue. Thus, **SSL\_get\_error**() must be used in the same thread that performed the TLS/SSL I/O operation, and no other OpenSSL function calls should appear in between. The current thread's error queue must be empty before the TLS/SSL I/O operation is attempted, or **SSL\_get\_error**() will not work reliably.

## RETURN VALUES

The following return values can currently occur:

- SSL\_ERROR\_NONE

  The TLS/SSL I/O operation completed. This result code is returned if and only if *ret* \> 0.

- SSL\_ERROR\_ZERO\_RETURN

  The TLS/SSL connection has been closed. If the protocol version is SSL 3.0 or TLS 1.0, this result code is returned only if a closure alert has occurred in the protocol, i.e., if the connection has been closed cleanly. Note that in this case SSL\_ERROR\_ZERO\_RETURN does not necessarily indicate that the underlying transport has been closed.

- SSL\_ERROR\_WANT\_READ, SSL\_ERROR\_WANT\_WRITE

  The operation did not complete; the same TLS/SSL I/O function should be called again later. If, by then, the underlying *BIO* has data available for reading (if the result code is SSL\_ERROR\_WANT\_READ) or allows writing data (SSL\_ERROR\_WANT\_WRITE), then some TLS/SSL protocol progress will take place, i.e., at least part of a TLS/SSL record will be read or written. Note that the retry may again lead to a SSL\_ERROR\_WANT\_READ or SSL\_ERROR\_WANT\_WRITE condition. There is no fixed upper limit for the number of iterations that may be necessary until progress becomes visible at application protocol level.

  For socket*BIO* s (e.g., when **SSL\_set\_fd**() was used), [select(2)](/select/2.md) or [poll(2)](/poll/2.md) on the underlying socket can be used to find out when the TLS/SSL I/O function should be retried.

  Caveat: Any TLS/SSL I/O function can lead to either of SSL\_ERROR\_WANT\_READ and SSL\_ERROR\_WANT\_WRITE. In particular, SSL\_read(3) or SSL\_peek(3) may want to write data and SSL\_write(3) may want to read data. This is mainly because TLS/SSL handshakes may occur at any time during the protocol (initiated by either the client or the server); SSL\_read(3), SSL\_peek(3), and SSL\_write(3) will handle any pending handshakes.

- SSL\_ERROR\_WANT\_CONNECT, SSL\_ERROR\_WANT\_ACCEPT

  The operation did not complete; the same TLS/SSL I/O function should be called again later. The underlying BIO was not connected yet to the peer and the call would block in[connect(2)](/connect/2.md)/ [accept(2)](/accept/2.md). The SSL function should be called again when the connection is established. These messages can only appear with a BIO\_s\_connect(3) or BIO\_s\_accept(3) *BIO*, respectively. In order to find out when the connection has been successfully established, on many platforms [select(2)](/select/2.md) or [poll(2)](/poll/2.md) for writing on the socket file descriptor can be used.

- SSL\_ERROR\_WANT\_X509\_LOOKUP

  The operation did not complete because an application callback set by SSL\_CTX\_set\_client\_cert\_cb(3) has asked to be called again. The TLS/SSL I/O function should be called again later. Details depend on the application.

- SSL\_ERROR\_SYSCALL

  Some I/O error occurred. The OpenSSL error queue may contain more information on the error. If the error queue is empty (i.e., **ERR\_get\_error**() returns 0), *ret* can be used to find out more about the error: If *ret* == 0, an EOF was observed that violates the protocol. If *ret* == −1, the underlying *BIO* reported an I/O error (for socket I/O on Unix systems, consult errno for details).

- SSL\_ERROR\_SSL

  A failure in the SSL library occurred, usually a protocol error. The OpenSSL error queue contains more information on the error.

## SEE ALSO

[err(3)](/err/3.md), [ssl(3)](/ssl/3.md)

## HISTORY

**SSL\_get\_error**() first appeared in SSLeay 0.8.0 and have been available since OpenBSD 2.4.