---
name: "libressl-SSL_get_state"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-SSL_get_state"
---

# libressl-SSL\_get\_state(3)

inspect the state of the SSL state machine

## NAME

**SSL\_get\_state**, **SSL\_state**, **SSL\_in\_accept\_init**, **SSL\_in\_before**, **SSL\_in\_connect\_init**, **SSL\_in\_init**, **SSL\_is\_init\_finished** – inspect the state of the SSL state machine

## SYNOPSIS

SSL Library (libssl, -lssl) libcrypto

**#include \<openssl/ssl.h\>**

*int*\

**SSL\_get\_state**(*const SSL \*ssl*);

*int*\

**SSL\_state**(*const SSL \*ssl*);

*int*\

**SSL\_in\_accept\_init**(*const SSL \*ssl*);

*int*\

**SSL\_in\_before**(*const SSL \*ssl*);

*int*\

**SSL\_in\_connect\_init**(*const SSL \*ssl*);

*int*\

**SSL\_in\_init**(*const SSL \*ssl*);

*int*\

**SSL\_is\_init\_finished**(*const SSL \*ssl*);

## DESCRIPTION

**SSL\_get\_state**() returns an encoded representation of the current state of the SSL state machine. **SSL\_state**() is a deprecated alias for **SSL\_get\_state**().

The following bits may be set:

- SSL\_ST\_ACCEPT

  This bit is set by SSL\_accept(3) and by SSL\_set\_accept\_state(3). It indicates that *ssl* is set up for server mode and no client initiated the TLS handshake yet. The function **SSL\_in\_accept\_init**() returns non-zero if this bit is set or 0 otherwise.

- SSL\_ST\_BEFORE

  This bit is set by the SSL\_accept(3), SSL\_connect(3), SSL\_set\_accept\_state(3), and SSL\_set\_connect\_state(3) functions. It indicates that the TLS handshake was not initiated yet. The function **SSL\_in\_before**() returns non-zero if this bit is set or 0 otherwise.

- SSL\_ST\_CONNECT

  This bit is set by SSL\_connect(3) and by SSL\_set\_connect\_state(3). It indicates that *ssl* is set up for client mode and no TLS handshake was initiated yet. The function **SSL\_in\_connect\_init**() returns non-zero if this bit is set or 0 otherwise.

The following masks can be used:

- SSL\_ST\_INIT

  Set if SSL\_ST\_ACCEPT or SSL\_ST\_CONNECT is set. The function **SSL\_in\_init**() returns a non-zero value if one of these is set or 0 otherwise.

- SSL\_ST\_MASK

  This mask includes all bits except SSL\_ST\_ACCEPT, SSL\_ST\_BEFORE, and SSL\_ST\_CONNECT.

- SSL\_ST\_OK

  The state is set to this value when a connection is established. The function **SSL\_is\_init\_finished**() returns a non-zero value if the state equals this constant, or 0 otherwise.

- SSL\_ST\_RENEGOTIATE

  The program is about to renegotiate, for example when entering SSL\_read(3) or SSL\_write(3) right after SSL\_renegotiate(3) was called.

The meaning of other bits is protocol-dependent. Application programs usually do not need to inspect any of those other bits.

All these functions may be implemented as macros.

## SEE ALSO

[ssl(3)](/ssl/3.md), SSL\_renegotiate(3), SSL\_set\_connect\_state(3)

## HISTORY

**SSL\_is\_init\_finished**() first appeared in SSLeay 0.4.5b. **SSL\_state**() first appeared in SSLeay 0.5.2. **SSL\_in\_accept\_init**(), **SSL\_in\_connect\_init**(), and **SSL\_in\_init**() first appeared in SSLeay 0.6.0. **SSL\_in\_before**() first appeared in SSLeay 0.8.0. **SSL\_get\_state**() first appeared in SSLeay 0.9.0. All these functions have been available since OpenBSD 2.4.