SSL_CTX_set1_curves to specify curves in Client Hello Supported Group Extension, not working

Rohit Kaushal rohit.kaushal at
Tue Nov 26 08:11:15 UTC 2019


I would like to ask if anyone here has actually been able to trim the EC
Supported Groups in the Client Hello with a TLS-ECDHE cipher using the APIs
described in the OpenSSL v1.0.2 manpage for SSL_CTX_set1_curves()

My shared objects are built using OpenSSL v1.0.2t with FIPS Object Module
v2.0.5 . The TLS handshake pcap has always shown myCipher (
"ECDHE-RSA-AES128-GCM-SHA256") in the Client Hello correctly, accompanied
with 13 curves in the Supported Group Extension. However, enhancing SSL_CTX
myCtx to restrict the curves to just 3 (P-521:P384:P256) still show the
same 13 curves as in the pcap. The man page doesn't suggest nor do i see
any reason why FIPS should prevent this from working.

//existing working code

if((myCtx = SSL_CTX_new(SSL_METHOD *)TLSv1_2_method()) == NULL)


if((SSL_CTX_set_cipher_list(myCtx, myCipher) != 1))


//enhancement, not working

if(SSL_CTX_set1_curves(myCtx, "P-521:P-384:P-256", 3)) != 1))


The API returns 0 (suggesting no error), but pcap shows no change, i.e.
still shows the std. 13 curves.

Trying a code snippet involving SSL_CONF_cmd(myConfCtx, "-named-curve",
"P-256") suggested in this link
available prior to SSL_CTX_set1_curves() introduction in v1.0.2, didn’t
help either.

Thank you for any guidance you can provide.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <>

More information about the openssl-users mailing list