Inventory OpenSSL Algorithms, Providers and Features

Someone asks whether this box supports AES-256-GCM, and openssl list is how you answer without guessing. The guide takes about ten minutes. It only reads OpenSSL's current configuration and build information, so it does not need elevated privileges and does not change keys, certificates, services or system files.

1. Confirm the executable and version

Start by checking which binary your shell will run. This matters when a distribution package, a locally built copy and a language runtime have different OpenSSL installations:

$ command -v openssl
/usr/bin/openssl
$ openssl version
OpenSSL 3.6.1 27 Jan 2026 (Library: OpenSSL 3.6.1 27 Jan 2026)

Your version and path can differ. The local openssl-list(1ssl) page identifies itself as OpenSSL 3.0.13, while the executable used for the examples here reports 3.6.1. Treat command output as authoritative for the binary you are testing, and do not assume an option or provider available on one host exists on another.

2. List commands in a script-friendly form

Use -commands to see standard OpenSSL subcommands. Put -1 first for one command per line, which pipes cleanly into a shell or a review tool:

$ openssl list -1 -commands | sed -n '1,8p'
asn1parse
ca
ciphers
cmp
cms
configutl
crl
crl2pkcs7

• It is an inventory, not a security recommendation. A command appearing here means this executable knows about it, not that a particular protocol, provider or policy permits every operation.
• Avoid parsing the normal multi-column output when a script needs stable line boundaries; use -1 instead.

To inspect the options accepted by another OpenSSL command, use -options. The result is an internal two-column check, not a general purpose help replacement:

$ openssl list -options dgst | sed -n '1,8p'
help -
list -
engine s
engine_impl -
passin s
c -
r -
out >

The second column shows whether an option takes a parameter. If the named command is absent or your build behaves differently, treat that as a compatibility warning rather than copying the option straight into a production script.

3. Inspect algorithms by family

Choose the inventory that answers your question: symmetric ciphers, message digests, key derivation functions and message authentication codes each get their own listing.

$ openssl list -digest-algorithms | sed -n '1,12p'
Legacy:
  RSA-MD4 => MD4
  RSA-MD5 => MD5
  RSA-MDC2 => MDC2
  RSA-RIPEMD160 => RIPEMD160
  RSA-SHA1 => SHA1
  RSA-SHA1-2 => RSA-SHA1
  RSA-SHA224 => SHA224
  RSA-SHA256 => SHA256
  RSA-SHA3-224 => SHA3-224
  RSA-SHA3-256 => SHA3-256
  RSA-SHA3-384 => SHA3-384

$ openssl list -cipher-algorithms | grep -i 'aes-256-gcm'
  { 2.16.840.1.101.3.4.1.46, aes-256-gcm, id-aes256-GCM } @ default

Algorithm output can contain aliases. A line such as RSA-SHA256 => SHA256 maps a legacy name to its main name. Provider-backed implementations are marked with an at-sign and the provider name, for example @ default. Do not treat every alias as a separate implementation.

-select name narrows algorithm listings by name. For an exact, repeatable check, select a known algorithm and inspect the complete line:

$ openssl list -select AES-256-GCM -cipher-algorithms
Legacy:
Provided:
  { 2.16.840.1.101.3.4.1.46, aes-256-gcm, id-aes256-GCM } @ default

Use -verbose when provider implementation details matter. For algorithm families and providers it adds supported parameters or fuller provider information, which is more useful for diagnosis but less convenient to compare line by line.

4. Check providers before blaming an algorithm

OpenSSL 3 loads algorithm implementations through providers. List the providers currently loaded by this process:

$ openssl list -providers
Providers:
  default
    name: OpenSSL Default Provider
    version: 3.6.1
    status: active

The list depends on configuration, environment and command-line provider options. A provider can be installed but not loaded, and an algorithm can exist in a provider that this particular invocation did not load. When testing a configured provider, pass its name explicitly:

$ openssl list -provider PROVIDER_NAME -providers

Replace PROVIDER_NAME with a provider actually installed on the host. Do not guess a module name or download one just to make a failed test pass. If you need a provider module from a non-standard directory, -provider-path PATH changes where OpenSSL looks; that is a configuration and trust decision, so review the path and ownership before using it.

Property queries also affect which implementations are selected. -propquery passes a property query to OpenSSL. Keep such a query visible in diagnostics: two otherwise identical commands can list different results when their provider properties differ.

5. Find disabled features and built-in objects

To distinguish an unloaded provider from a feature compiled out of the installation, ask for disabled features:

$ openssl list -disabled
Disabled algorithms:
MD2
RC5
SCTP
SSL3
ZLIB
BROTLI
ZSTD

The names are build-specific. A disabled entry is not fixed by adding a provider at runtime. Rebuilding or replacing OpenSSL is a separate, security-sensitive change and should follow your platform's package and change-control process.

-objects lists built-in object identifiers and names. Useful when checking whether a certificate or protocol trace uses an object known to this installation:

$ openssl list -objects | sed -n '1,5p'
rsadsi = RSA Data Security, Inc., 1.2.840.113549
pkcs = RSA Data Security, Inc. PKCS, 1.2.840.113549.1
MD2 = md2, 1.2.840.113549.2.2
MD5 = md5, 1.2.840.113549.2.5
RC4 = rc4, 1.2.840.113549.3.4

Common traps

• Using deprecated inventory names. -digest-commands, -cipher-commands and -engines are deprecated in OpenSSL 3. Use -digest-algorithms and -cipher-algorithms instead; engines belong to the older extension model and listing one does not make it suitable for a modern provider-based configuration.
• Pasting a full inventory into a ticket. Save the exact command, version, provider list and relevant inventory together for troubleshooting, but do not paste host-specific information your organisation treats as sensitive. A short filtered result is normally enough to prove whether a named implementation is available.
• Reaching for sudo when output is empty. Repeat the check without a filter first, then compare openssl version -a, openssl list -providers and the environment used by the failing application. sudo can select a different configuration and hide a path or permissions problem. None of these commands alter state, so there is no undo step needed either way.