#use wml::openssl-macros area=docs page=SSL_get_error

<title>Documents, SSL_get_error(3)</title>

<h1>SSL_get_error(3)</h1>

#use wml::imp::generic

{:
## What's this? [[s|(<STRONG>[^<].+?)</A>(</STRONG><DD>)|$1$2|sg]]
[[s|<P>\s+<P>|<P>|sg]]
[[s|<P>\s+</|</|sg]]
[[s|<DD>\s*<DT>|<DD>&nbsp;<DT>|sg]]
[[s|<DD>\s*</DL>|<DD>&nbsp;</DL>|sg]]
[[s|\[|&#91;|sg]]
[[s|\]|&#93;|sg]]

<!-- INDEX BEGIN -->

<UL>

	<LI><A HREF="#NAME">NAME</A>
	<LI><A HREF="#SYNOPSIS">SYNOPSIS</A>
	<LI><A HREF="#DESCRIPTION">DESCRIPTION</A>
	<LI><A HREF="#RETURN_VALUES">RETURN VALUES</A>
	<LI><A HREF="#SEE_ALSO">SEE ALSO</A>
	<LI><A HREF="#HISTORY">HISTORY</A>
</UL>
<!-- INDEX END -->

<HR>
<P>
<HR>
<H1><A NAME="NAME">NAME</A></H1>
<P>
SSL_get_error - obtain result code for TLS/SSL I/O operation

</P>
<P>
<HR>
<H1><A NAME="SYNOPSIS">SYNOPSIS</A></H1>
<PRE> #include &lt;openssl/ssl.h&gt;
</PRE>
<PRE> int SSL_get_error(const SSL *ssl, int ret);
</PRE>
<P>
<HR>
<H1><A NAME="DESCRIPTION">DESCRIPTION</A></H1>
<P>
<CODE>SSL_get_error()</CODE> returns a result code (suitable for the C
``switch'' statement) for a preceding call to <CODE>SSL_connect(),</CODE>
<CODE>SSL_accept(),</CODE> <CODE>SSL_do_handshake(),</CODE>
<CODE>SSL_read(),</CODE> <CODE>SSL_peek(),</CODE> or
<CODE>SSL_write()</CODE> on <STRONG>ssl</STRONG>. The value returned by that TLS/SSL I/O function must be passed to
<CODE>SSL_get_error()</CODE> in parameter
<STRONG>ret</STRONG>.

</P>
<P>
In addition to <STRONG>ssl</STRONG> and <STRONG>ret</STRONG>, <CODE>SSL_get_error()</CODE> inspects the current thread's OpenSSL error
queue. Thus, <CODE>SSL_get_error()</CODE> must be used in the same thread
that performed the TLS/SSL I/O operation, and no other OpenSSL function
calls should appear in between. The current thread's error queue must be
empty before the TLS/SSL I/O operation is attempted, or
<CODE>SSL_get_error()</CODE> will not work reliably.

</P>
<P>
<HR>
<H1><A NAME="RETURN_VALUES">RETURN VALUES</A></H1>
<P>
The following return values can currently occur:

</P>
<DL>
<DT><STRONG><A NAME="item_SSL_ERROR_NONE">SSL_ERROR_NONE</A></STRONG><DD>
<P>
The TLS/SSL I/O operation completed. This result code is returned if and
only if <STRONG>ret &gt; 0</STRONG>.

</P>
<DT><STRONG><A NAME="item_SSL_ERROR_ZERO_RETURN">SSL_ERROR_ZERO_RETURN</A></STRONG><DD>
<P>
The TLS/SSL connection has been closed. If the protocol version is SSL 3.0
or TLS 1.0, this result code is returned only if a closure alert has
occurred in the protocol, i.e. if the connection has been closed cleanly.
Note that in this case <STRONG>SSL_ERROR_ZERO_RETURN</STRONG>
does not necessarily indicate that the underlying transport has been
closed.

</P>
<DT><STRONG><A NAME="item_SSL_ERROR_WANT_READ">SSL_ERROR_WANT_READ, SSL_ERROR_WANT_WRITE</A></STRONG><DD>
<P>
The operation did not complete; the same TLS/SSL I/O function should be
called again later. If, by then, the underlying <STRONG>BIO</STRONG> has data available for reading (if the result code is <STRONG>SSL_ERROR_WANT_READ</STRONG>) or allows writing data (<STRONG>SSL_ERROR_WANT_WRITE</STRONG>), then some TLS/SSL protocol progress will take place, i.e. at least part
of an TLS/SSL record will be read or written. Note that the retry may again
lead to a <STRONG>SSL_ERROR_WANT_READ</STRONG> or <STRONG>SSL_ERROR_WANT_WRITE</STRONG> condition. There is no fixed upper limit for the number of iterations that
may be necessary until progress becomes visible at application protocol
level.

</P>
<P>
For socket <STRONG>BIO</STRONG>s (e.g. when <CODE>SSL_set_fd()</CODE> was used), <CODE>select()</CODE> or
<CODE>poll()</CODE> on the underlying socket can be used to find out when
the TLS/SSL I/O function should be retried.

</P>
<P>
Caveat: Any TLS/SSL I/O function can lead to either of
<STRONG>SSL_ERROR_WANT_READ</STRONG> and <STRONG>SSL_ERROR_WANT_WRITE</STRONG>. In particular, <CODE>SSL_read()</CODE> or <CODE>SSL_peek()</CODE> may
want to write data and <CODE>SSL_write()</CODE> may want to read data. This
is mainly because TLS/SSL handshakes may occur at any time during the
protocol (initiated by either the client or the server);
<CODE>SSL_read(),</CODE> <CODE>SSL_peek(),</CODE> and
<CODE>SSL_write()</CODE> will handle any pending handshakes.

</P>
<DT><STRONG><A NAME="item_SSL_ERROR_WANT_CONNECT">SSL_ERROR_WANT_CONNECT, SSL_ERROR_WANT_ACCEPT</A></STRONG><DD>
<P>
The operation did not complete; the same TLS/SSL I/O function should be
called again later. The underlying BIO was not connected yet to the peer
and the call would block in <CODE>connect()/accept().</CODE> The SSL
function should be called again when the connection is established. These
messages can only appear with a <CODE>BIO_s_connect()</CODE> or
<CODE>BIO_s_accept()</CODE> BIO, respectively. In order to find out, when
the connection has been successfully established, on many platforms
<CODE>select()</CODE> or <CODE>poll()</CODE> for writing on the socket file
descriptor can be used.

</P>
<DT><STRONG><A NAME="item_SSL_ERROR_WANT_X509_LOOKUP">SSL_ERROR_WANT_X509_LOOKUP</A></STRONG><DD>
<P>
The operation did not complete because an application callback set by
<CODE>SSL_CTX_set_client_cert_cb()</CODE> has asked to be called again. The
TLS/SSL I/O function should be called again later. Details depend on the
application.

</P>
<DT><STRONG><A NAME="item_SSL_ERROR_SYSCALL">SSL_ERROR_SYSCALL</A></STRONG><DD>
<P>
Some I/O error occurred. The OpenSSL error queue may contain more
information on the error. If the error queue is empty (i.e.
<CODE>ERR_get_error()</CODE> returns 0), <STRONG>ret</STRONG> can be used to find out more about the error: If <STRONG>ret == 0</STRONG>, an EOF was observed that violates the protocol. If <STRONG>ret == -1</STRONG>, the underlying <STRONG>BIO</STRONG> reported an I/O error (for socket I/O on Unix systems, consult <STRONG>errno</STRONG> for details).

</P>
<DT><STRONG><A NAME="item_SSL_ERROR_SSL">SSL_ERROR_SSL</A></STRONG><DD>
<P>
A failure in the SSL library occurred, usually a protocol error. The
OpenSSL error queue contains more information on the error.

</P>
</DL>
<P>
<HR>
<H1><A NAME="SEE_ALSO">SEE ALSO</A></H1>
<P>
<A HREF="../ssl/ssl.html#">ssl(3)</A>, <A HREF="../crypto/err.html#">err(3)</A>



</P>
<P>
<HR>
<H1><A NAME="HISTORY">HISTORY</A></H1>
<P>
<CODE>SSL_get_error()</CODE> was added in SSLeay 0.8.

</P>
:}