---
name: "ne_ssl_context_create"
section: "3"
platform: "linux"
package: "neon"
version: "0.37.1-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/ne_ssl_context_create"
---

# ne\_ssl\_context\_create(3)

SSL context management functions

## NAME

ne\_ssl\_context\_create, ne\_ssl\_context\_trustcert, ne\_ssl\_context\_trustdefca, ne\_ssl\_context\_keypair, ne\_ssl\_context\_set\_clicert, ne\_ssl\_context\_set\_ccprovide, ne\_ssl\_context\_set\_versions, ne\_ssl\_context\_set\_verify, ne\_ssl\_context\_set\_flag, ne\_ssl\_context\_get\_flag, ne\_ssl\_context\_destroy - SSL context management functions

## SYNOPSIS

```
#include <ne_ssl.h>
```

**ne\_ssl\_context \*ne\_ssl\_context\_create(int** *mode***);**

**void ne\_ssl\_context\_trustcert(ne\_ssl\_context \****ctx***, const ne\_ssl\_certificate \****cert***);**

**void ne\_ssl\_context\_trustdefca(ne\_ssl\_context \****ctx***);**

**int ne\_ssl\_context\_keypair(ne\_ssl\_context \****ctx***, const char \****cert***, const char \****key***);**

**void ne\_ssl\_context\_set\_clicert(ne\_ssl\_context \****ctx***, const ne\_ssl\_client\_cert \****cc***);**

**void ne\_ssl\_context\_set\_ccprovide(ne\_ssl\_context \****ctx***, ne\_ssl\_ccprovide\_fn** *provider***, void \****userdata***);**

**int ne\_ssl\_context\_set\_versions(ne\_ssl\_context \****ctx***, enum ne\_ssl\_protocol** *min***, enum ne\_ssl\_protocol** *max***);**

**int ne\_ssl\_context\_set\_verify(ne\_ssl\_context \****ctx***, int** *required***, const char \****ca\_names***, const char \****verify\_cas***);**

**void ne\_ssl\_context\_set\_flag(ne\_ssl\_context \****ctx***, int** *flag***, int** *value***);**

**int ne\_ssl\_context\_get\_flag(ne\_ssl\_context \****ctx***, int** *flag***);**

**void ne\_ssl\_context\_destroy(ne\_ssl\_context \****ctx***);**

## DESCRIPTION

The **ne\_ssl\_context\_create** function creates an SSL context object. The *mode* parameter should be **NE\_SSL\_CTX\_CLIENT** for a client context, **NE\_SSL\_CTX\_SERVER** for a server context.

For a client context, the **ne\_ssl\_context\_trustcert** function configures the context to trust the certificate *cert*. The **ne\_ssl\_context\_trustdefca** function configures the context to trust the default system certificate authorities.

For a server context, the **ne\_ssl\_context\_keypair** function configures the server certificate and private key. The *cert* and *key* parameters are filenames to PEM-encoded certificates.

The **ne\_ssl\_context\_set\_clicert** function configures a client certificate for a client context. The client certificate *cc* must be in the decrypted state. The certificate object is duplicated internally and may be destroyed by the caller after the function returns.

The **ne\_ssl\_context\_set\_ccprovide** function registers a callback to provide a client certificate on demand if requested by the server. The *provider* callback is passed the *userdata* pointer, an array of acceptable CA distinguished names, and the count of names in the array.

The **ne\_ssl\_context\_set\_versions** function sets the minimum and maximum SSL/TLS protocol versions allowed for the connection. This must be called before initiating the SSL handshake.

For a server context, the **ne\_ssl\_context\_set\_verify** function configures client certificate verification. If *required* is non-zero, a client certificate is required. If *ca\_names* is non-NULL, it specifies a filename containing PEM certificates from which CA names are sent in the client certificate request. The *verify\_cas* parameter specifies CAs used for verification.

The **ne\_ssl\_context\_set\_flag** function sets a flag for the SSL context. The **ne\_ssl\_context\_get\_flag** function retrieves the current value of a flag. No flags are currently defined.

The **ne\_ssl\_context\_destroy** function destroys an SSL context object and frees all associated resources.

## RETURN VALUE

**ne\_ssl\_context\_create** returns an SSL context object, or NULL on error.

**ne\_ssl\_context\_keypair**, **ne\_ssl\_context\_set\_versions**, and **ne\_ssl\_context\_set\_verify** return zero on success, or non-zero on error.

**ne\_ssl\_context\_get\_flag** returns the flag value.

## HISTORY

**ne\_ssl\_context\_set\_clicert** and **ne\_ssl\_context\_trustdefca** are available in neon 0.37.0 and later.

## SEE ALSO

[**ne\_sock\_handshake**(3)](/ne_sock_handshake/3.md)

## COPYRIGHT

Copyright © 2001-2026 Joe Orton\