From c534d536beb70625c0cf46bb27e68942d96ef76e Mon Sep 17 00:00:00 2001
From: BUSH Steve 00036997 <steven.bush@3ds.com>
Date: Mon, 20 Jul 2026 12:52:05 -0700
Subject: [PATCH] Allow setting additional openssl CTX options from client
 applications when calling SSL_CTX_set_options() during server or client
 Openssl handshakes (#600)

---
 ixwebsocket/IXSocketOpenSSL.cpp    | 7 ++++++-
 ixwebsocket/IXSocketTLSOptions.cpp | 5 +++++
 ixwebsocket/IXSocketTLSOptions.h   | 5 +++++
 3 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/ixwebsocket/IXSocketOpenSSL.cpp b/ixwebsocket/IXSocketOpenSSL.cpp
index 5f38715e..e2d823d1 100644
--- a/ixwebsocket/IXSocketOpenSSL.cpp
+++ b/ixwebsocket/IXSocketOpenSSL.cpp
@@ -561,6 +561,11 @@ namespace ix
             return false;
         }
 
+        if (_tlsOptions.hasAdditionalOptions())
+        {
+            SSL_CTX_set_options(_ssl_context, _tlsOptions.additional_openssl_ctx_options);
+        }
+
         return true;
     }
 
@@ -598,7 +603,7 @@ namespace ix
                         SSL_CTX_set_mode(_ssl_context, SSL_MODE_ENABLE_PARTIAL_WRITE);
                         SSL_CTX_set_mode(_ssl_context, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
                         SSL_CTX_set_options(_ssl_context,
-                                            SSL_OP_ALL | SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3);
+                                            SSL_OP_ALL | SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | _tlsOptions.additional_openssl_ctx_options);
                     }
                 }
             }
diff --git a/ixwebsocket/IXSocketTLSOptions.cpp b/ixwebsocket/IXSocketTLSOptions.cpp
index 5800ccdc..6d1cede0 100644
--- a/ixwebsocket/IXSocketTLSOptions.cpp
+++ b/ixwebsocket/IXSocketTLSOptions.cpp
@@ -49,6 +49,11 @@ namespace ix
         return true;
     }
 
+    bool SocketTLSOptions::hasAdditionalOptions() const
+    {
+        return additional_openssl_ctx_options != 0;
+    }
+
     bool SocketTLSOptions::hasCertAndKey() const
     {
         return !certFile.empty() && !keyFile.empty();
diff --git a/ixwebsocket/IXSocketTLSOptions.h b/ixwebsocket/IXSocketTLSOptions.h
index 2b5793b5..3fbf6eca 100644
--- a/ixwebsocket/IXSocketTLSOptions.h
+++ b/ixwebsocket/IXSocketTLSOptions.h
@@ -36,6 +36,11 @@ namespace ix
         // whether to skip validating the peer's hostname against the certificate presented
         bool disable_hostname_validation = false;
 
+        // additional OpenSSL CTX options to set when calling SSL_CTX_set_options during the handshake
+        uint64_t additional_openssl_ctx_options = 0;
+
+        bool hasAdditionalOptions() const;
+
         bool hasCertAndKey() const;
 
         bool isUsingSystemDefaults() const;