Inspect OpenSSL Providers, Algorithms and Build Features

You will use openssl list to answer a practical question: what commands, algorithms and providers does this installation expose? The guide takes about ten minutes. It only reads OpenSSL's current configuration and build information, so it does not need elevated privileges and does not change keys, certificates, services or system files.

1. Confirm the executable and version

Start by checking which binary your shell will run. This matters when a distribution package, a locally built copy and a language runtime have different OpenSSL installations:

$ command -v openssl
/usr/bin/openssl
$ openssl version
OpenSSL 3.6.1 27 Jan 2026 (Library: OpenSSL 3.6.1 27 Jan 2026)

Your version and path can differ. The local openssl-list(1ssl) page identifies itself as OpenSSL 3.0.13, while the executable used for the examples here reports 3.6.1. Treat command output as authoritative for the binary you are testing, and do not assume that an option or provider available on one host exists on another.

Checkpoint: if command -v points into an unexpected virtual environment or application directory, stop and resolve that path before comparing results with a service that may use another library.

2. List commands in a script-friendly form

Use -commands to see standard OpenSSL subcommands. Put -1 first when you want one command per line, which is easier to pipe into a shell or a review tool:

$ openssl list -1 -commands | sed -n '1,8p'
asn1parse
ca
ciphers
cmp
cms
configutl
crl
crl2pkcs7

This is an inventory, not a security recommendation. A command appearing here means that this executable knows about it; it does not prove that a particular protocol, provider or policy permits every operation. Avoid parsing the normal multi-column output when a script needs stable line boundaries.

To inspect the options accepted by another OpenSSL command, use -options. The result is an internal two-column check, not a general purpose help replacement:

$ openssl list -options dgst | sed -n '1,8p'
help -
list -
engine s
engine_impl -
passin s
c -
r -
out >

The second column indicates whether an option takes a parameter. If the named command is absent or your OpenSSL build behaves differently, use that result as a compatibility warning rather than copying the option into a production script.

3. Inspect algorithms by family

Choose the inventory that answers your question. The common families are symmetric ciphers, message digests, key derivation functions and message authentication codes:

$ openssl list -digest-algorithms | sed -n '1,12p'
Legacy:
  RSA-MD4 => MD4
  RSA-MD5 => MD5
  RSA-MDC2 => MDC2
  RSA-RIPEMD160 => RIPEMD160
  RSA-SHA1 => SHA1
  RSA-SHA1-2 => RSA-SHA1
  RSA-SHA224 => SHA224
  RSA-SHA256 => SHA256
  RSA-SHA3-224 => SHA3-224
  RSA-SHA3-256 => SHA3-256
  RSA-SHA3-384 => SHA3-384

$ openssl list -cipher-algorithms | grep -i 'aes-256-gcm'
  { 2.16.840.1.101.3.4.1.46, aes-256-gcm, id-aes256-GCM } @ default

Algorithm output can contain aliases. A line such as RSA-SHA256 => SHA256 maps a legacy name to its main name. Provider-backed implementations are marked with an at-sign and the provider name, for example @ default. Do not interpret every alias as a separate implementation.

-select name narrows algorithm listings by name. For an exact, repeatable check, select a known algorithm and inspect the complete line:

$ openssl list -select AES-256-GCM -cipher-algorithms
Legacy:
Provided:
  { 2.16.840.1.101.3.4.1.46, aes-256-gcm, id-aes256-GCM } @ default

Use -verbose when provider implementation details are relevant. For algorithm families and providers it adds supported parameters or fuller provider information, so the output is more useful for diagnosis but less convenient to compare line by line.

4. Check providers before blaming an algorithm

OpenSSL 3 loads algorithm implementations through providers. List the providers currently loaded by this process:

$ openssl list -providers
Providers:
  default
    name: OpenSSL Default Provider
    version: 3.6.1
    status: active

The list depends on configuration, environment and command-line provider options. A provider can be installed but not loaded, and an algorithm can exist in a provider that this particular invocation did not load. When testing a configured provider, pass its name explicitly:

$ openssl list -provider PROVIDER_NAME -providers

Replace PROVIDER_NAME with a provider actually installed on the host. Do not guess a module name or download one to make a failed test pass. If you need a provider module from a non-standard directory, -provider-path PATH changes where OpenSSL looks; that is a configuration and trust decision, so review the path and ownership before using it.

Property queries also affect which implementations are selected. The -propquery option passes a property query to OpenSSL. Keep such a query visible in diagnostics, because two otherwise identical commands can list different results when their provider properties differ.

5. Find disabled features and built-in objects

To distinguish an unloaded provider from a feature compiled out of the installation, ask for disabled features:

$ openssl list -disabled
Disabled algorithms:
MD2
RC5
SCTP
SSL3
ZLIB
BROTLI
ZSTD

The names are build-specific. A disabled entry is not fixed by adding a provider at runtime. Rebuilding or replacing OpenSSL is a separate, security-sensitive change and should follow your platform's package and change-control process.

-objects lists built-in object identifiers and names. This is useful when checking whether a certificate or protocol trace uses an object known to this installation:

$ openssl list -objects | sed -n '1,5p'
rsadsi = RSA Data Security, Inc., 1.2.840.113549
pkcs = RSA Data Security, Inc. PKCS, 1.2.840.113549.1
MD2 = md2, 1.2.840.113549.2.2
MD5 = md5, 1.2.840.113549.2.5
RC4 = rc4, 1.2.840.113549.3.4

6. Avoid deprecated inventory names

The older -digest-commands, -cipher-commands and -engines options are deprecated in OpenSSL 3. Use -digest-algorithms and -cipher-algorithms for current algorithm inventories. Engines belong to the older extension model; listing one does not make it suitable for a modern provider-based configuration.

For troubleshooting, save the exact command, version, provider list and relevant inventory together. Do not paste a full inventory into a ticket if it exposes host-specific information that your organisation treats as sensitive. A short filtered result is normally enough to prove whether a named implementation is available.

If output is unexpectedly empty, repeat the check without a filter, then compare openssl version -a, openssl list -providers and the environment used by the failing application. Do not use sudo as a first response: it can select a different configuration and hide a path or permissions problem. These commands do not alter state, so there is no undo step.