Add OpenSSL::SSL::SSLContext#client_hello_cb= (binding for SSL_CTX_set_client_hello_cb()) #1125
Description
How about adding OpenSSL::SSL::SSLContext#client_hello_cb=, a binding for SSL_CTX_set_client_hello_cb()?
Motivation
Apache httpd and nginx use the ClientHello callback for SNI-based virtual host selection:
- Apache httpd (mod_ssl): apache/httpd@076e283
- nginx: nginx/nginx@0373fe5d98c1
OpenSSL::SSL::SSLContext#servername_cb= uses the servername callback (SSL_CTX_set_tlsext_servername_callback()) for the same purpose.
The ClientHello callback is invoked at the beginning of ClientHello processing, before the protocol version is negotiated. The servername callback is invoked after that. So settings of the SSLContext selected by SNI, such as min_version and max_version, can take effect only when the context is switched in the ClientHello callback. Both commits above describe this as the reason for the change.
Compatibility
- OpenSSL 1.1.1 or later: supported
- AWS-LC: supported (
SSL_CTX_set_client_hello_cb()is available) - LibreSSL: not supported (the API isn't available)
Activity
kou commentedon Oct 13, 2026
#1126 is an implementation of this.
ssl: add `SSLContext#client_hello_cb=`
rhenium commentedon Oct 13, 2026
This seems useful. However, I would prefer not to allow it to replace the
SSLContext.SSL_set_SSL_CTX()has very strange and inconsistent semantics, and I expect it will eventually go away, since I don't see how it could be made to behave in a sane way. A related discussion on OpenSSL's issue tracker is openssl/openssl#6109.My understanding is that the recommendation is to configure
SSLobject directly instead. We should first add more configuration accessors toSSLSocket, such asSSLSocket#add_certificateor#min_version=so they can be called from withinclient_hello_cb, which currently exist only onSSLContext.I think a remaining question is which accessors
SSLSocketshould get. Maybe all?Unrelated, but some existing callbacks such as
servername_cbandclient_cert_cb(which currently has no way to return intermediate CA certificates) could also benefit from those new accessors.kou commentedon Oct 13, 2026
It makes sense. Let's use the approach. We can do it step by step.