4 This document describes installation on all supported operating
5 systems: the Unix/Linux family (including macOS), OpenVMS,
11 - [Prerequisites](#prerequisites)
12 - [Notational Conventions](#notational-conventions)
13 - [Quick Installation Guide](#quick-installation-guide)
14 - [Building OpenSSL](#building-openssl)
15 - [Installing OpenSSL](#installing-openssl)
16 - [Configuration Options](#configuration-options)
17 - [API Level](#api-level)
18 - [Cross Compile Prefix](#cross-compile-prefix)
19 - [Build Type](#build-type)
20 - [Directories](#directories)
21 - [Compiler Warnings](#compiler-warnings)
22 - [ZLib Flags](#zlib-flags)
23 - [Seeding the Random Generator](#seeding-the-random-generator)
24 - [Setting the FIPS HMAC key](#setting-the-FIPS-HMAC-key)
25 - [Enable and Disable Features](#enable-and-disable-features)
26 - [Displaying configuration data](#displaying-configuration-data)
27 - [Installation Steps in Detail](#installation-steps-in-detail)
28 - [Configure](#configure-openssl)
29 - [Build](#build-openssl)
30 - [Test](#test-openssl)
31 - [Install](#install-openssl)
32 - [Advanced Build Options](#advanced-build-options)
33 - [Environment Variables](#environment-variables)
34 - [Makefile Targets](#makefile-targets)
35 - [Running Selected Tests](#running-selected-tests)
36 - [Troubleshooting](#troubleshooting)
37 - [Configuration Problems](#configuration-problems)
38 - [Build Failures](#build-failures)
39 - [Test Failures](#test-failures)
41 - [Notes on multi-threading](#notes-on-multi-threading)
42 - [Notes on shared libraries](#notes-on-shared-libraries)
43 - [Notes on random number generation](#notes-on-random-number-generation)
44 - [Notes on assembler modules compilation](#notes-on-assembler-modules-compilation)
49 To install OpenSSL, you will need:
51 * A "make" implementation
52 * Perl 5 with core modules (please read [NOTES-PERL.md](NOTES-PERL.md))
53 * The Perl module `Text::Template` (please read [NOTES-PERL.md](NOTES-PERL.md))
55 * a development environment in the form of development libraries and C
57 * a supported operating system
59 For additional platform specific requirements, solutions to specific
60 issues and other details, please read one of these:
62 * [Notes for UNIX-like platforms](NOTES-UNIX.md)
63 * [Notes for Android platforms](NOTES-ANDROID.md)
64 * [Notes for Windows platforms](NOTES-WINDOWS.md)
65 * [Notes for the DOS platform with DJGPP](NOTES-DJGPP.md)
66 * [Notes for the OpenVMS platform](NOTES-VMS.md)
67 * [Notes on Perl](NOTES-PERL.md)
68 * [Notes on Valgrind](NOTES-VALGRIND.md)
70 Notational conventions
71 ======================
73 Throughout this document, we use the following conventions.
78 Any line starting with a dollar sign is a command line.
82 The dollar sign indicates the shell prompt and is not to be entered as
88 Several words in curly braces separated by pipe characters indicate a
89 **mandatory choice**, to be replaced with one of the given words.
92 $ echo { WORD1 | WORD2 | WORD3 }
94 represents one of the following three commands
102 One or several words in square brackets separated by pipe characters
103 denote an **optional choice**. It is similar to the mandatory choice,
104 but it can also be omitted entirely.
108 $ echo [ WORD1 | WORD2 | WORD3 ]
110 represents one of the four commands
123 **Mandatory arguments** are enclosed in double curly braces.
124 A simple example would be
126 $ type {{ filename }}
128 which is to be understood to use the command `type` on some file name
129 determined by the user.
131 **Optional Arguments** are enclosed in double square brackets.
135 Note that the notation assumes spaces around `{`, `}`, `[`, `]`, `{{`, `}}` and
136 `[[`, `]]`. This is to differentiate from OpenVMS directory
137 specifications, which also use [ and ], but without spaces.
139 Quick Installation Guide
140 ========================
142 If you just want to get OpenSSL installed without bothering too much
143 about the details, here is the short version of how to build and install
144 OpenSSL. If any of the following steps fails, please consult the
145 [Installation in Detail](#installation-steps-in-detail) section below.
150 Use the following commands to configure, build and test OpenSSL.
151 The testing is optional, but recommended if you intend to install
152 OpenSSL for production use.
154 ### Unix / Linux / macOS
162 Use the following commands to build OpenSSL:
170 If you are using Visual Studio, open a Developer Command Prompt and
171 issue the following commands to build OpenSSL.
177 As mentioned in the [Choices](#choices) section, you need to pick one
178 of the four Configure targets in the first command.
180 Most likely you will be using the `VC-WIN64A` target for 64bit Windows
181 binaries (AMD64) or `VC-WIN32` for 32bit Windows binaries (X86).
182 The other two options are `VC-WIN64I` (Intel IA64, Itanium) and
183 `VC-CE` (Windows CE) are rather uncommon nowadays.
188 The following commands will install OpenSSL to a default system location.
190 **Danger Zone:** even if you are impatient, please read the following two
191 paragraphs carefully before you install OpenSSL.
193 For security reasons the default system location is by default not writable
194 for unprivileged users. So for the final installation step administrative
195 privileges are required. The default system location and the procedure to
196 obtain administrative privileges depends on the operating system.
197 It is recommended to compile and test OpenSSL with normal user privileges
198 and use administrative privileges only for the final installation step.
200 On some platforms OpenSSL is preinstalled as part of the Operating System.
201 In this case it is highly recommended not to overwrite the system versions,
202 because other applications or libraries might depend on it.
203 To avoid breaking other applications, install your copy of OpenSSL to a
204 [different location](#installing-to-a-different-location) which is not in
205 the global search path for system libraries.
207 Finally, if you plan on using the FIPS module, you need to read the
208 [Post-installation Notes](#post-installation-notes) further down.
210 ### Unix / Linux / macOS
212 Depending on your distribution, you need to run the following command as
213 root user or prepend `sudo` to the command:
217 By default, OpenSSL will be installed to
221 More precisely, the files will be installed into the subdirectories
228 depending on the file type, as it is custom on Unix-like operating systems.
232 Use the following command to install OpenSSL.
236 By default, OpenSSL will be installed to
242 If you are using Visual Studio, open the Developer Command Prompt _elevated_
243 and issue the following command.
247 The easiest way to elevate the Command Prompt is to press and hold down both
248 the `<CTRL>` and `<SHIFT>` keys while clicking the menu item in the task menu.
250 The default installation location is
252 C:\Program Files\OpenSSL
254 for native binaries, or
256 C:\Program Files (x86)\OpenSSL
258 for 32bit binaries on 64bit Windows (WOW64).
260 #### Installing to a different location
262 To install OpenSSL to a different location (for example into your home
263 directory for testing purposes) run `Configure` as shown in the following
266 The options `--prefix` and `--openssldir` are explained in further detail in
267 [Directories](#directories) below, and the values used here are mere examples.
271 $ ./Configure --prefix=/opt/openssl --openssldir=/usr/local/ssl
275 $ perl Configure --prefix=PROGRAM:[INSTALLS] --openssldir=SYS$MANAGER:[OPENSSL]
277 Note: if you do add options to the configuration command, please make sure
278 you've read more than just this Quick Start, such as relevant `NOTES-*` files,
279 the options outline below, as configuration options may change the outcome
280 in otherwise unexpected ways.
282 Configuration Options
283 =====================
285 There are several options to `./Configure` to customize the build (note that
286 for Windows, the defaults for `--prefix` and `--openssldir` depend on what
287 configuration is used and what Windows implementation OpenSSL is built on.
288 For more information, see the [Notes for Windows platforms](NOTES-WINDOWS.md).
295 Build the OpenSSL libraries to support the API for the specified version.
296 If [no-deprecated](#no-deprecated) is also given, don't build with support
297 for deprecated APIs in or below the specified version number. For example,
300 --api=1.1.0 no-deprecated
302 will remove support for all APIs that were deprecated in OpenSSL version
303 1.1.0 or below. This is a rather specialized option for developers.
304 If you just intend to remove all deprecated APIs up to the current version
305 entirely, just specify [no-deprecated](#no-deprecated).
306 If `--api` isn't given, it defaults to the current (minor) OpenSSL version.
311 --cross-compile-prefix=<PREFIX>
313 The `<PREFIX>` to include in front of commands for your toolchain.
315 It is likely to have to end with dash, e.g. `a-b-c-` would invoke GNU compiler
316 as `a-b-c-gcc`, etc. Unfortunately cross-compiling is too case-specific to put
317 together one-size-fits-all instructions. You might have to pass more flags or
318 set up environment variables to actually make it work. Android and iOS cases
319 are discussed in corresponding `Configurations/15-*.conf` files. But there are
320 cases when this option alone is sufficient. For example to build the mingw64
321 target on Linux `--cross-compile-prefix=x86_64-w64-mingw32-` works. Naturally
322 provided that mingw packages are installed. Today Debian and Ubuntu users
323 have option to install a number of prepackaged cross-compilers along with
324 corresponding run-time and development packages for "alien" hardware. To give
325 another example `--cross-compile-prefix=mipsel-linux-gnu-` suffices in such
328 For cross compilation, you must [configure manually](#manual-configuration).
329 Also, note that `--openssldir` refers to target's file system, not one you are
337 Build OpenSSL with debugging symbols and zero optimization level.
341 Build OpenSSL without debugging symbols. This is the default.
350 The name of the directory under the top of the installation directory tree
351 (see the `--prefix` option) where libraries will be installed. By default
352 this is `lib`. Note that on Windows only static libraries (`*.lib`) will
353 be stored in this location. Shared libraries (`*.dll`) will always be
354 installed to the `bin` directory.
356 Some build targets have a multilib postfix set in the build configuration.
357 For these targets the default libdir is `lib<multilib-postfix>`. Please use
358 `--libdir=lib` to override the libdir if adding the postfix is undesirable.
364 Directory for OpenSSL configuration files, and also the default certificate
365 and key store. Defaults are:
368 Windows: C:\Program Files\Common Files\SSL
369 OpenVMS: SYS$COMMON:[OPENSSL-COMMON]
371 For 32bit Windows applications on Windows 64bit (WOW64), always replace
372 `C:\Program Files` by `C:\Program Files (x86)`.
378 The top of the installation directory tree. Defaults are:
381 Windows: C:\Program Files\OpenSSL
382 OpenVMS: SYS$COMMON:[OPENSSL]
389 This is a developer flag that switches on various compiler options recommended
390 for OpenSSL development. It only works when using gcc or clang as the compiler.
391 If you are developing a patch for OpenSSL then it is recommended that you use
392 this option where possible.
397 ### with-zlib-include
399 --with-zlib-include=DIR
401 The directory for the location of the zlib include file. This option is only
402 necessary if [zlib](#zlib) is used and the include file is not
403 already on the system include path.
409 **On Unix**: this is the directory containing the zlib library.
410 If not provided the system library path will be used.
412 **On Windows:** this is the filename of the zlib library (with or
413 without a path). This flag must be provided if the
414 [zlib-dynamic](#zlib-dynamic) option is not also used. If `zlib-dynamic` is used
415 then this flag is optional and defaults to `ZLIB1` if not provided.
417 **On VMS:** this is the filename of the zlib library (with or without a path).
418 This flag is optional and if not provided then `GNV$LIBZSHR`, `GNV$LIBZSHR32`
419 or `GNV$LIBZSHR64` is used by default depending on the pointer size chosen.
421 Seeding the Random Generator
422 ----------------------------
424 --with-rand-seed=seed1[,seed2,...]
426 A comma separated list of seeding methods which will be tried by OpenSSL
427 in order to obtain random input (a.k.a "entropy") for seeding its
428 cryptographically secure random number generator (CSPRNG).
429 The current seeding methods are:
433 Use a trusted operating system entropy source.
434 This is the default method if such an entropy source exists.
438 Use the [getrandom(2)][man-getrandom] or equivalent system call.
440 [man-getrandom]: http://man7.org/linux/man-pages/man2/getrandom.2.html
444 Use the first device from the `DEVRANDOM` list which can be opened to read
445 random bytes. The `DEVRANDOM` preprocessor constant expands to
447 "/dev/urandom","/dev/random","/dev/srandom"
449 on most unix-ish operating systems.
453 Check for an entropy generating daemon.
454 This source is ignored by the FIPS provider.
458 Use the `RDSEED` or `RDRAND` command on x86 or `RNDRRS` command on aarch64
459 if provided by the CPU.
463 Use librandom (not implemented yet).
464 This source is ignored by the FIPS provider.
468 Disable automatic seeding. This is the default on some operating systems where
469 no suitable entropy source exists, or no support for it is implemented yet.
470 This option is ignored by the FIPS provider.
472 For more information, see the section [Notes on random number generation][rng]
473 at the end of this document.
475 [rng]: #notes-on-random-number-generation
477 Setting the FIPS HMAC key
478 -------------------------
482 As part of its self-test validation, the FIPS module must verify itself
483 by performing a SHA-256 HMAC computation on itself. The default key is
484 the SHA256 value of "the holy handgrenade of antioch" and is sufficient
485 for meeting the FIPS requirements.
487 To change the key to a different value, use this flag. The value should
488 be a hex string no more than 64 characters.
490 Enable and Disable Features
491 ---------------------------
493 Feature options always come in pairs, an option to enable feature
494 `xxxx`, and an option to disable it:
496 [ enable-xxxx | no-xxxx ]
498 Whether a feature is enabled or disabled by default, depends on the feature.
499 In the following list, always the non-default variant is documented: if
500 feature `xxxx` is disabled by default then `enable-xxxx` is documented and
501 if feature `xxxx` is enabled by default then `no-xxxx` is documented.
505 Don't build the AFALG engine.
507 This option will be forced on a platform that does not support AFALG.
511 Build with Kernel TLS support.
513 This option will enable the use of the Kernel TLS data-path, which can improve
514 performance and allow for the use of sendfile and splice system calls on
515 TLS sockets. The Kernel may use TLS accelerators if any are available on the
516 system. This option will be forced off on systems that do not support the
517 Kernel TLS data-path.
521 Build with the Address sanitiser.
523 This is a developer option only. It may not work on all platforms and should
524 never be used in production environments. It will only work when used with
525 gcc or clang and should be used in conjunction with the [no-shared](#no-shared)
528 ### enable-acvp-tests
530 Build support for Automated Cryptographic Validation Protocol (ACVP)
533 This is required for FIPS validation purposes. Certain ACVP tests require
534 access to algorithm internals that are not normally accessible.
535 Additional information related to ACVP can be found at
536 <https://github.com/usnistgov/ACVP>.
540 Do not use assembler code.
542 This should be viewed as debugging/troubleshooting option rather than for
543 production use. On some platforms a small amount of assembler code may still
544 be used even with this option.
548 Do not build support for async operations.
552 Don't automatically load all supported ciphers and digests.
554 Typically OpenSSL will make available all of its supported ciphers and digests.
555 For a statically linked application this may be undesirable if small executable
556 size is an objective. This only affects libcrypto. Ciphers and digests will
557 have to be loaded manually using `EVP_add_cipher()` and `EVP_add_digest()`
558 if this option is used. This option will force a non-shared build.
562 Don't automatically load all libcrypto/libssl error strings.
564 Typically OpenSSL will automatically load human readable error strings. For a
565 statically linked application this may be undesirable if small executable size
568 ### no-autoload-config
570 Don't automatically load the default `openssl.cnf` file.
572 Typically OpenSSL will automatically load a system config file which configures
575 ### enable-buildtest-c++
577 While testing, generate C++ buildtest files that simply check that the public
578 OpenSSL header files are usable standalone with C++.
580 Enabling this option demands extra care. For any compiler flag given directly
581 as configuration option, you must ensure that it's valid for both the C and
582 the C++ compiler. If not, the C++ build test will most likely break. As an
583 alternative, you can use the language specific variables, `CFLAGS` and `CXXFLAGS`.
587 Use the specified text instead of the default banner at the end of
592 On platforms where the choice of 32-bit or 64-bit architecture
593 is not explicitly specified, `Configure` will print a warning
594 message and wait for a few seconds to let you interrupt the
595 configuration. Using this flag skips the wait.
599 Build only some minimal set of features.
600 This is a developer option used internally for CI build tests of the project.
604 Never cache algorithms when they are fetched from a provider. Normally, a
605 provider indicates if the algorithms it supplies can be cached or not. Using
606 this option will reduce run-time memory usage but it also introduces a
607 significant performance penalty. This option is primarily designed to help
608 with detecting incorrect reference counting.
612 Don't build the CAPI engine.
614 This option will be forced if on a platform that does not support CAPI.
618 Don't build support for Certificate Management Protocol (CMP)
619 and Certificate Request Message Format (CRMF).
623 Don't build support for Cryptographic Message Syntax (CMS).
627 Don't build support for SSL/TLS compression.
629 If this option is enabled (the default), then compression will only work if
630 the zlib or `zlib-dynamic` options are also chosen.
632 ### enable-crypto-mdebug
634 This now only enables the `failed-malloc` feature.
636 ### enable-crypto-mdebug-backtrace
638 This is a no-op; the project uses the compiler's address/leak sanitizer instead.
642 Don't build support for Certificate Transparency (CT).
646 Don't build with support for deprecated APIs up until and including the version
647 given with `--api` (or the current version, if `--api` wasn't specified).
651 Don't build support for datagram based BIOs.
653 Selecting this option will also force the disabling of DTLS.
657 Don't build support for loading Dynamic Shared Objects (DSO)
659 ### enable-devcryptoeng
661 Build the `/dev/crypto` engine.
663 This option is automatically selected on the BSD platform, in which case it can
664 be disabled with `no-devcryptoeng`.
666 ### no-dynamic-engine
668 Don't build the dynamically loaded engines.
670 This only has an effect in a shared build.
674 Don't build support for Elliptic Curves.
678 Don't build support for binary Elliptic Curves
680 ### enable-ec_nistp_64_gcc_128
682 Enable support for optimised implementations of some commonly used NIST
685 This option is only supported on platforms:
687 - with little-endian storage of non-byte types
688 - that tolerate misaligned memory references
689 - where the compiler:
690 - supports the non-standard type `__uint128_t`
691 - defines the built-in macro `__SIZEOF_INT128__`
695 Build support for gathering entropy from the Entropy Gathering Daemon (EGD).
699 Don't build support for loading engines.
703 Don't compile in any error strings.
705 ### enable-external-tests
707 Enable building of integration with external test suites.
709 This is a developer option and may not work on all platforms. The following
710 external test suites are currently supported:
712 - GOST engine test suite
713 - Python PYCA/Cryptography test suite
716 See the file [test/README-external.md](test/README-external.md)
721 Don't compile in filename and line number information (e.g. for errors and
726 Build (and install) the FIPS provider
728 ### no-fips-securitychecks
730 Don't perform FIPS module run-time checks related to enforcement of security
731 parameters such as minimum security strength of keys.
733 ### enable-fuzz-libfuzzer, enable-fuzz-afl
735 Build with support for fuzzing using either libfuzzer or AFL.
737 These are developer options only. They may not work on all platforms and
738 should never be used in production environments.
740 See the file [fuzz/README.md](fuzz/README.md) for further details.
744 Don't build support for GOST based ciphersuites.
746 Note that if this feature is enabled then GOST ciphersuites are only available
747 if the GOST algorithms are also available through loading an externally supplied
752 Don't build the legacy provider.
754 Disabling this also disables the legacy algorithms: MD2 (already disabled by default).
758 Don't generate dependencies.
762 Don't build any dynamically loadable engines.
764 This also implies `no-dynamic-engine`.
768 Don't build support for writing multiple records in one go in libssl
770 Note: this is a different capability to the pipelining functionality.
774 Don't build support for the Next Protocol Negotiation (NPN) TLS extension.
778 Don't build support for Online Certificate Status Protocol (OCSP).
782 Don't build the padlock engine.
786 As synonym for `no-padlockeng`. Deprecated and should not be used.
790 Don't build with support for Position Independent Code.
794 Don't pin the shared libraries.
796 By default OpenSSL will attempt to stay in memory until the process exits.
797 This is so that libcrypto and libssl can be properly cleaned up automatically
798 via an `atexit()` handler. The handler is registered by libcrypto and cleans
799 up both libraries. On some platforms the `atexit()` handler will run on unload of
800 libcrypto (if it has been dynamically loaded) rather than at process exit.
802 This option can be used to stop OpenSSL from attempting to stay in memory until the
803 process exits. This could lead to crashes if either libcrypto or libssl have
804 already been unloaded at the point that the atexit handler is invoked, e.g. on a
805 platform which calls `atexit()` on unload of the library, and libssl is unloaded
806 before libcrypto then a crash is likely to happen.
808 Note that shared library pinning is not automatically disabled for static builds,
809 i.e., `no-shared` does not imply `no-pinshared`. This may come as a surprise when
810 linking libcrypto statically into a shared third-party library, because in this
811 case the shared library will be pinned. To prevent this behaviour, you need to
812 configure the static build using `no-shared` and `no-pinshared` together.
814 Applications can suppress running of the `atexit()` handler at run time by
815 using the `OPENSSL_INIT_NO_ATEXIT` option to `OPENSSL_init_crypto()`.
816 See the man page for it for further details.
820 Don't use POSIX IO capabilities.
824 Don't build support for Pre-Shared Key based ciphersuites.
828 Don't use hardware RDRAND capabilities.
832 Don't build support for RFC3779, "X.509 Extensions for IP Addresses and
837 Build support for Stream Control Transmission Protocol (SCTP).
841 Do not create shared libraries, only static ones.
843 See [Notes on shared libraries](#notes-on-shared-libraries) below.
847 Don't build support for socket BIOs.
851 Don't build support for Secure Remote Password (SRP) protocol or
852 SRP based ciphersuites.
856 Don't build Secure Real-Time Transport Protocol (SRTP) support.
860 Exclude SSE2 code paths from 32-bit x86 assembly modules.
862 Normally SSE2 extension is detected at run-time, but the decision whether or not
863 the machine code will be executed is taken solely on CPU capability vector. This
864 means that if you happen to run OS kernel which does not support SSE2 extension
865 on Intel P4 processor, then your application might be exposed to "illegal
866 instruction" exception. There might be a way to enable support in kernel, e.g.
867 FreeBSD kernel can be compiled with `CPU_ENABLE_SSE`, and there is a way to
868 disengage SSE2 code paths upon application start-up, but if you aim for wider
869 "audience" running such kernel, consider `no-sse2`. Both the `386` and `no-asm`
870 options imply `no-sse2`.
874 Don't build with SSL Trace capabilities.
876 This removes the `-trace` option from `s_client` and `s_server`, and omits the
877 `SSL_trace()` function from libssl.
879 Disabling `ssl-trace` may provide a small reduction in libssl binary size.
883 Don't build the statically linked engines.
885 This only has an impact when not built "shared".
889 Don't use anything from the C header file `stdio.h` that makes use of the `FILE`
890 type. Only libcrypto and libssl can be built in this way. Using this option will
891 suppress building the command line applications. Additionally, since the OpenSSL
892 tests also use the command line applications, the tests will also be skipped.
896 Don't build test programs or run any tests.
900 Don't build with support for multi-threaded applications.
904 Build with support for multi-threaded applications. Most platforms will enable
905 this by default. However, if on a platform where this is not the case then this
906 will usually require additional system-dependent options!
908 See [Notes on multi-threading](#notes-on-multi-threading) below.
912 Build with support for the integrated tracing api.
914 See manual pages OSSL_trace_set_channel(3) and OSSL_trace_enabled(3) for details.
918 Don't build Time Stamping (TS) Authority support.
922 Build with the Undefined Behaviour sanitiser (UBSAN).
924 This is a developer option only. It may not work on all platforms and should
925 never be used in production environments. It will only work when used with
926 gcc or clang and should be used in conjunction with the `-DPEDANTIC` option
927 (or the `--strict-warnings` option).
931 Don't build with the User Interface (UI) console method
933 The User Interface console method enables text based console prompts.
937 Enable additional unit test APIs.
939 This should not typically be used in production deployments.
943 Don't build support for UPLINK interface.
945 ### enable-weak-ssl-ciphers
947 Build support for SSL/TLS ciphers that are considered "weak"
949 Enabling this includes for example the RC4 based ciphersuites.
953 Build with support for zlib compression/decompression.
957 Like the zlib option, but has OpenSSL load the zlib library dynamically
960 This is only supported on systems where loading of shared libraries is supported.
964 In 32-bit x86 builds, use the 80386 instruction set only in assembly modules
966 The default x86 code is more efficient, but requires at least an 486 processor.
967 Note: This doesn't affect compiler generated code, so this option needs to be
968 accompanied by a corresponding compiler-specific option.
972 no-{ssl|ssl3|tls|tls1|tls1_1|tls1_2|tls1_3|dtls|dtls1|dtls1_2}
974 Don't build support for negotiating the specified SSL/TLS protocol.
976 If `no-tls` is selected then all of `tls1`, `tls1_1`, `tls1_2` and `tls1_3`
978 Similarly `no-dtls` will disable `dtls1` and `dtls1_2`. The `no-ssl` option is
979 synonymous with `no-ssl3`. Note this only affects version negotiation.
980 OpenSSL will still provide the methods for applications to explicitly select
981 the individual protocol versions.
983 ### no-{protocol}-method
985 no-{ssl3|tls1|tls1_1|tls1_2|dtls1|dtls1_2}-method
987 Analogous to `no-{protocol}` but in addition do not build the methods for
988 applications to explicitly select individual protocol versions. Note that there
989 is no `no-tls1_3-method` option because there is no application method for
992 Using individual protocol methods directly is deprecated. Applications should
993 use `TLS_method()` instead.
995 ### enable-{algorithm}
999 Build with support for the specified algorithm.
1003 no-{aria|bf|blake2|camellia|cast|chacha|cmac|
1004 des|dh|dsa|ecdh|ecdsa|idea|md4|mdc2|ocb|
1005 poly1305|rc2|rc4|rmd160|scrypt|seed|
1006 siphash|siv|sm2|sm3|sm4|whirlpool}
1008 Build without support for the specified algorithm.
1010 The `ripemd` algorithm is deprecated and if used is synonymous with `rmd160`.
1012 ### Compiler-specific options
1014 -Dxxx, -Ixxx, -Wp, -lxxx, -Lxxx, -Wl, -rpath, -R, -framework, -static
1016 These system specific options will be recognised and passed through to the
1017 compiler to allow you to define preprocessor symbols, specify additional
1018 libraries, library directories or other compiler options. It might be worth
1019 noting that some compilers generate code specifically for processor the
1020 compiler currently executes on. This is not necessarily what you might have
1021 in mind, since it might be unsuitable for execution on other, typically older,
1022 processor. Consult your compiler documentation.
1024 Take note of the [Environment Variables](#environment-variables) documentation
1025 below and how these flags interact with those variables.
1029 Additional options that are not otherwise recognised are passed through as
1030 they are to the compiler as well. Unix-style options beginning with a
1031 `-` or `+` and Windows-style options beginning with a `/` are recognised.
1032 Again, consult your compiler documentation.
1034 If the option contains arguments separated by spaces, then the URL-style
1035 notation `%20` can be used for the space character in order to avoid having
1036 to quote the option. For example, `-opt%20arg` gets expanded to `-opt arg`.
1037 In fact, any ASCII character can be encoded as %xx using its hexadecimal
1040 Take note of the [Environment Variables](#environment-variables) documentation
1041 below and how these flags interact with those variables.
1043 ### Environment Variables
1047 Assign the given value to the environment variable `VAR` for `Configure`.
1049 These work just like normal environment variable assignments, but are supported
1050 on all platforms and are confined to the configuration scripts only.
1051 These assignments override the corresponding value in the inherited environment,
1054 The following variables are used as "`make` variables" and can be used as an
1055 alternative to giving preprocessor, compiler and linker options directly as
1056 configuration. The following variables are supported:
1058 AR The static library archiver.
1059 ARFLAGS Flags for the static library archiver.
1060 AS The assembler compiler.
1061 ASFLAGS Flags for the assembler compiler.
1063 CFLAGS Flags for the C compiler.
1064 CXX The C++ compiler.
1065 CXXFLAGS Flags for the C++ compiler.
1066 CPP The C/C++ preprocessor.
1067 CPPFLAGS Flags for the C/C++ preprocessor.
1068 CPPDEFINES List of CPP macro definitions, separated
1069 by a platform specific character (':' or
1070 space for Unix, ';' for Windows, ',' for
1071 VMS). This can be used instead of using
1072 -D (or what corresponds to that on your
1073 compiler) in CPPFLAGS.
1074 CPPINCLUDES List of CPP inclusion directories, separated
1075 the same way as for CPPDEFINES. This can
1076 be used instead of -I (or what corresponds
1077 to that on your compiler) in CPPFLAGS.
1078 HASHBANGPERL Perl invocation to be inserted after '#!'
1079 in public perl scripts (only relevant on
1081 LD The program linker (not used on Unix, $(CC)
1083 LDFLAGS Flags for the shared library, DSO and
1085 LDLIBS Extra libraries to use when linking.
1086 Takes the form of a space separated list
1087 of library specifications on Unix and
1088 Windows, and as a comma separated list of
1090 RANLIB The library archive indexer.
1091 RC The Windows resource compiler.
1092 RCFLAGS Flags for the Windows resource compiler.
1093 RM The command to remove files and directories.
1095 These cannot be mixed with compiling/linking flags given on the command line.
1096 In other words, something like this isn't permitted.
1098 $ ./Configure -DFOO CPPFLAGS=-DBAR -DCOOKIE
1100 Backward compatibility note:
1102 To be compatible with older configuration scripts, the environment variables
1103 are ignored if compiling/linking flags are given on the command line, except
1106 AR, CC, CXX, CROSS_COMPILE, HASHBANGPERL, PERL, RANLIB, RC, and WINDRES
1108 For example, the following command will not see `-DBAR`:
1110 $ CPPFLAGS=-DBAR ./Configure -DCOOKIE
1112 However, the following will see both set variables:
1114 $ CC=gcc CROSS_COMPILE=x86_64-w64-mingw32- ./Configure -DCOOKIE
1116 If `CC` is set, it is advisable to also set `CXX` to ensure both the C and C++
1117 compiler are in the same "family". This becomes relevant with
1118 `enable-external-tests` and `enable-buildtest-c++`.
1125 Reconfigure from earlier data.
1127 This fetches the previous command line options and environment from data
1128 saved in `configdata.pm` and runs the configuration process again, using
1129 these options and environment. Note: NO other option is permitted together
1130 with `reconf`. Note: The original configuration saves away values for ALL
1131 environment variables that were used, and if they weren't defined, they are
1132 still saved away with information that they weren't originally defined.
1133 This information takes precedence over environment variables that are
1134 defined when reconfiguring.
1136 Displaying configuration data
1137 -----------------------------
1139 The configuration script itself will say very little, and finishes by
1140 creating `configdata.pm`. This perl module can be loaded by other scripts
1141 to find all the configuration data, and it can also be used as a script to
1142 display all sorts of configuration data in a human readable form.
1144 For more information, please do:
1146 $ ./configdata.pm --help # Unix
1150 $ perl configdata.pm --help # Windows and VMS
1152 Installation Steps in Detail
1153 ============================
1158 ### Automatic Configuration
1160 In previous version, the `config` script determined the platform type and
1161 compiler and then called `Configure`. Starting with this release, they are
1164 #### Unix / Linux / macOS
1166 $ ./Configure [[ options ]]
1170 $ perl Configure [[ options ]]
1174 $ perl Configure [[ options ]]
1176 ### Manual Configuration
1178 OpenSSL knows about a range of different operating system, hardware and
1179 compiler combinations. To see the ones it knows about, run
1181 $ ./Configure LIST # Unix
1185 $ perl Configure LIST # All other platforms
1187 For the remainder of this text, the Unix form will be used in all examples.
1188 Please use the appropriate form for your platform.
1190 Pick a suitable name from the list that matches your system. For most
1191 operating systems there is a choice between using cc or gcc.
1192 When you have identified your system (and if necessary compiler) use this
1193 name as the argument to `Configure`. For example, a `linux-elf` user would
1196 $ ./Configure linux-elf [[ options ]]
1198 ### Creating your own Configuration
1200 If your system isn't listed, you will have to create a configuration
1201 file named `Configurations/{{ something }}.conf` and add the correct
1202 configuration for your system. See the available configs as examples
1203 and read [Configurations/README.md](Configurations/README.md) and
1204 [Configurations/README-design.md](Configurations/README-design.md)
1205 for more information.
1207 The generic configurations `cc` or `gcc` should usually work on 32 bit
1210 `Configure` creates a build file (`Makefile` on Unix, `makefile` on Windows
1211 and `descrip.mms` on OpenVMS) from a suitable template in `Configurations/`,
1212 and defines various macros in `include/openssl/configuration.h` (generated
1213 from `include/openssl/configuration.h.in`.
1215 If none of the generated build files suit your purpose, it's possible to
1216 write your own build file template and give its name through the environment
1217 variable `BUILDFILE`. For example, Ninja build files could be supported by
1218 writing `Configurations/build.ninja.tmpl` and then configure with `BUILDFILE`
1219 set like this (Unix syntax shown, you'll have to adapt for other platforms):
1221 $ BUILDFILE=build.ninja perl Configure [options...]
1223 ### Out of Tree Builds
1225 OpenSSL can be configured to build in a build directory separate from the
1226 source code directory. It's done by placing yourself in some other
1227 directory and invoking the configuration commands from there.
1231 $ mkdir /var/tmp/openssl-build
1232 $ cd /var/tmp/openssl-build
1233 $ /PATH/TO/OPENSSL/SOURCE/Configure [[ options ]]
1235 #### OpenVMS example
1237 $ set default sys$login:
1238 $ create/dir [.tmp.openssl-build]
1239 $ set default [.tmp.openssl-build]
1240 $ perl D:[PATH.TO.OPENSSL.SOURCE]Configure [[ options ]]
1242 #### Windows example
1245 $ mkdir \temp-openssl
1247 $ perl d:\PATH\TO\OPENSSL\SOURCE\Configure [[ options ]]
1249 Paths can be relative just as well as absolute. `Configure` will do its best
1250 to translate them to relative paths whenever possible.
1255 Build OpenSSL by running:
1258 $ mms ! (or mmk) OpenVMS
1261 This will build the OpenSSL libraries (`libcrypto.a` and `libssl.a` on
1262 Unix, corresponding on other platforms) and the OpenSSL binary
1263 (`openssl`). The libraries will be built in the top-level directory,
1264 and the binary will be in the `apps/` subdirectory.
1266 If the build fails, take a look at the [Build Failures](#build-failures)
1267 subsection of the [Troubleshooting](#troubleshooting) section.
1272 After a successful build, and before installing, the libraries should
1276 $ mms test ! OpenVMS
1277 $ nmake test # Windows
1279 **Warning:** you MUST run the tests from an unprivileged account (or disable
1280 your privileges temporarily if your platform allows it).
1282 See [test/README.md](test/README.md) for further details how run tests.
1284 See [test/README-dev.md](test/README-dev.md) for guidelines on adding tests.
1289 If everything tests ok, install OpenSSL with
1291 $ make install # Unix
1292 $ mms install ! OpenVMS
1293 $ nmake install # Windows
1295 Note that in order to perform the install step above you need to have
1296 appropriate permissions to write to the installation directory.
1298 The above commands will install all the software components in this
1299 directory tree under `<PREFIX>` (the directory given with `--prefix` or
1302 ### Unix / Linux / macOS
1304 bin/ Contains the openssl binary and a few other
1307 Contains the header files needed if you want
1308 to build your own programs that use libcrypto
1310 lib Contains the OpenSSL library files.
1311 lib/engines Contains the OpenSSL dynamically loadable engines.
1313 share/man/man1 Contains the OpenSSL command line man-pages.
1314 share/man/man3 Contains the OpenSSL library calls man-pages.
1315 share/man/man5 Contains the OpenSSL configuration format man-pages.
1316 share/man/man7 Contains the OpenSSL other misc man-pages.
1318 share/doc/openssl/html/man1
1319 share/doc/openssl/html/man3
1320 share/doc/openssl/html/man5
1321 share/doc/openssl/html/man7
1322 Contains the HTML rendition of the man-pages.
1326 'arch' is replaced with the architecture name, `ALPHA` or `IA64`,
1327 'sover' is replaced with the shared library version (`0101` for 1.1), and
1328 'pz' is replaced with the pointer size OpenSSL was built with:
1330 [.EXE.'arch'] Contains the openssl binary.
1331 [.EXE] Contains a few utility scripts.
1333 Contains the header files needed if you want
1334 to build your own programs that use libcrypto
1336 [.LIB.'arch'] Contains the OpenSSL library files.
1337 [.ENGINES'sover''pz'.'arch']
1338 Contains the OpenSSL dynamically loadable engines.
1339 [.SYS$STARTUP] Contains startup, login and shutdown scripts.
1340 These define appropriate logical names and
1342 [.SYSTEST] Contains the installation verification procedure.
1343 [.HTML] Contains the HTML rendition of the manual pages.
1345 ### Additional Directories
1347 Additionally, install will add the following directories under
1348 OPENSSLDIR (the directory given with `--openssldir` or its default)
1349 for you convenience:
1351 certs Initially empty, this is the default location
1352 for certificate files.
1353 private Initially empty, this is the default location
1354 for private key files.
1355 misc Various scripts.
1357 The installation directory should be appropriately protected to ensure
1358 unprivileged users cannot make changes to OpenSSL binaries or files, or
1359 install engines. If you already have a pre-installed version of OpenSSL as
1360 part of your Operating System it is recommended that you do not overwrite
1361 the system version and instead install to somewhere else.
1363 Package builders who want to configure the library for standard locations,
1364 but have the package installed somewhere else so that it can easily be
1367 $ make DESTDIR=/tmp/package-root install # Unix
1368 $ mms/macro="DESTDIR=TMP:[PACKAGE-ROOT]" install ! OpenVMS
1370 The specified destination directory will be prepended to all installation
1373 Compatibility issues with previous OpenSSL versions
1374 ---------------------------------------------------
1376 ### COMPILING existing applications
1378 Starting with version 1.1.0, OpenSSL hides a number of structures that were
1379 previously open. This includes all internal libssl structures and a number
1380 of EVP types. Accessor functions have been added to allow controlled access
1381 to the structures' data.
1383 This means that some software needs to be rewritten to adapt to the new ways
1384 of doing things. This often amounts to allocating an instance of a structure
1385 explicitly where you could previously allocate them on the stack as automatic
1386 variables, and using the provided accessor functions where you would previously
1387 access a structure's field directly.
1389 Some APIs have changed as well. However, older APIs have been preserved when
1392 Post-installation Notes
1393 -----------------------
1395 With the default OpenSSL installation comes a FIPS provider module, which
1396 needs some post-installation attention, without which it will not be usable.
1397 This involves using the following command:
1399 $ openssl fipsinstall
1401 See the openssl-fipsinstall(1) manual for details and examples.
1403 Advanced Build Options
1404 ======================
1406 Environment Variables
1407 ---------------------
1409 A number of environment variables can be used to provide additional control
1410 over the build process. Typically these should be defined prior to running
1411 `Configure`. Not all environment variables are relevant to all platforms.
1414 The name of the ar executable to use.
1417 Use a different build file name than the platform default
1418 ("Makefile" on Unix-like platforms, "makefile" on native Windows,
1419 "descrip.mms" on OpenVMS). This requires that there is a
1420 corresponding build file template.
1421 See [Configurations/README.md](Configurations/README.md)
1422 for further information.
1425 The compiler to use. Configure will attempt to pick a default
1426 compiler for your platform but this choice can be overridden
1427 using this variable. Set it to the compiler executable you wish
1428 to use, e.g. gcc or clang.
1431 This environment variable has the same meaning as for the
1432 "--cross-compile-prefix" Configure flag described above. If both
1433 are set then the Configure flag takes precedence.
1436 The command string for the Perl executable to insert in the
1437 #! line of perl scripts that will be publicly installed.
1438 Default: /usr/bin/env perl
1439 Note: the value of this variable is added to the same scripts
1440 on all platforms, but it's only relevant on Unix-like platforms.
1443 This can be the value `32` or `64` to specify the architecture
1444 when it is not "obvious" to the configuration. It should generally
1445 not be necessary to specify this environment variable.
1448 The name of the nm executable to use.
1450 OPENSSL_LOCAL_CONFIG_DIR
1451 OpenSSL comes with a database of information about how it
1452 should be built on different platforms as well as build file
1453 templates for those platforms. The database is comprised of
1454 ".conf" files in the Configurations directory. The build
1455 file templates reside there as well as ".tmpl" files. See the
1456 file [Configurations/README.md](Configurations/README.md)
1457 for further information about the format of ".conf" files
1458 as well as information on the ".tmpl" files.
1459 In addition to the standard ".conf" and ".tmpl" files, it is
1460 possible to create your own ".conf" and ".tmpl" files and
1461 store them locally, outside the OpenSSL source tree.
1462 This environment variable can be set to the directory where
1463 these files are held and will be considered by Configure
1464 before it looks in the standard directories.
1467 The name of the Perl executable to use when building OpenSSL.
1468 Only needed if builing should use a different Perl executable
1469 than what is used to run the Configure script.
1472 The name of the ranlib executable to use.
1475 The name of the rc executable to use. The default will be as
1476 defined for the target platform in the ".conf" file. If not
1477 defined then "windres" will be used. The WINDRES environment
1478 variable is synonymous to this. If both are defined then RC
1487 The `Configure` script generates a Makefile in a format relevant to the specific
1488 platform. The Makefiles provide a number of targets that can be used. Not all
1489 targets may be available on all platforms. Only the most common targets are
1490 described here. Examine the Makefiles themselves for the full list.
1493 The target to build all the software components and
1497 Build all the software components.
1498 THIS IS THE DEFAULT TARGET.
1501 Build all documentation components.
1504 Remove all build artefacts and return the directory to a "clean"
1508 Rebuild the dependencies in the Makefiles. This is a legacy
1509 option that no longer needs to be used since OpenSSL 1.1.0.
1512 Install all OpenSSL components.
1515 Only install the OpenSSL software components.
1518 Only install the OpenSSL documentation components.
1521 Only install the OpenSSL man pages (Unix only).
1524 Only install the OpenSSL HTML documentation.
1527 Install the FIPS provider module configuration file.
1530 Prints a list of all the self test names.
1533 Build and run the OpenSSL self tests.
1536 Uninstall all OpenSSL components.
1540 Re-run the configuration process, as exactly as the last time
1544 This is a developer option. If you are developing a patch for
1545 OpenSSL you may need to use this if you want to update
1546 automatically generated files; add new error codes or add new
1547 (or change the visibility of) public API functions. (Unix only).
1549 Running Selected Tests
1550 ----------------------
1552 You can specify a set of tests to be performed
1553 using the `make` variable `TESTS`.
1555 See the section [Running Selected Tests of
1556 test/README.md](test/README.md#running-selected-tests).
1561 Configuration Problems
1562 ----------------------
1564 ### Selecting the correct target
1566 The `./Configure` script tries hard to guess your operating system, but in some
1567 cases it does not succeed. You will see a message like the following:
1570 Operating system: x86-whatever-minix
1571 This system (minix) is not supported. See file INSTALL.md for details.
1573 Even if the automatic target selection by the `./Configure` script fails,
1574 chances are that you still might find a suitable target in the `Configurations`
1575 directory, which you can supply to the `./Configure` command,
1576 possibly after some adjustment.
1578 The `Configurations/` directory contains a lot of examples of such targets.
1579 The main configuration file is [10-main.conf], which contains all targets that
1580 are officially supported by the OpenSSL team. Other configuration files contain
1581 targets contributed by other OpenSSL users. The list of targets can be found in
1582 a Perl list `my %targets = ( ... )`.
1587 inherit_from => [ "base-target" ],
1589 cflags => add("..."),
1591 perlasm_scheme => "...",
1596 If you call `./Configure` without arguments, it will give you a list of all
1597 known targets. Using `grep`, you can lookup the target definition in the
1598 `Configurations/` directory. For example the `android-x86_64` can be found in
1599 [Configurations/15-android.conf](Configurations/15-android.conf).
1601 The directory contains two README files, which explain the general syntax and
1602 design of the configuration files.
1604 - [Configurations/README.md](Configurations/README.md)
1605 - [Configurations/README-design.md](Configurations/README-design.md)
1607 If you need further help, try to search the [openssl-users] mailing list
1608 or the [GitHub Issues] for existing solutions. If you don't find anything,
1609 you can [raise an issue] to ask a question yourself.
1611 More about our support resources can be found in the [SUPPORT] file.
1613 ### Configuration Errors
1615 If the `./Configure` or `./Configure` command fails with an error message,
1616 read the error message carefully and try to figure out whether you made
1617 a mistake (e.g., by providing a wrong option), or whether the script is
1618 working incorrectly. If you think you encountered a bug, please
1619 [raise an issue] on GitHub to file a bug report.
1621 Along with a short description of the bug, please provide the complete
1622 configure command line and the relevant output including the error message.
1624 Note: To make the output readable, please add a 'code fence' (three backquotes
1625 ` ``` ` on a separate line) before and after your output:
1628 ./Configure [your arguments...]
1637 If the build fails, look carefully at the output. Try to locate and understand
1638 the error message. It might be that the compiler is already telling you
1639 exactly what you need to do to fix your problem.
1641 There may be reasons for the failure that aren't problems in OpenSSL itself,
1642 for example if the compiler reports missing standard or third party headers.
1644 If the build succeeded previously, but fails after a source or configuration
1645 change, it might be helpful to clean the build tree before attempting another
1646 build. Use this command:
1649 $ mms clean ! (or mmk) OpenVMS
1650 $ nmake clean # Windows
1652 Assembler error messages can sometimes be sidestepped by using the `no-asm`
1653 configuration option. See also [notes](#notes-on-assembler-modules-compilation).
1655 Compiling parts of OpenSSL with gcc and others with the system compiler will
1656 result in unresolved symbols on some systems.
1658 If you are still having problems, try to search the [openssl-users] mailing
1659 list or the [GitHub Issues] for existing solutions. If you think you
1660 encountered an OpenSSL bug, please [raise an issue] to file a bug report.
1661 Please take the time to review the existing issues first; maybe the bug was
1662 already reported or has already been fixed.
1667 If some tests fail, look at the output. There may be reasons for the failure
1668 that isn't a problem in OpenSSL itself (like an OS malfunction or a Perl issue).
1670 You may want increased verbosity, that can be accomplished as described in
1671 section [Test Failures of test/README.md](test/README.md#test-failures).
1673 You may also want to selectively specify which test(s) to perform. This can be
1674 done using the `make` variable `TESTS` as described in section [Running
1675 Selected Tests of test/README.md](test/README.md#running-selected-tests).
1677 If you find a problem with OpenSSL itself, try removing any
1678 compiler optimization flags from the `CFLAGS` line in the Makefile and
1679 run `make clean; make` or corresponding.
1681 To report a bug please open an issue on GitHub, at
1682 <https://github.com/openssl/openssl/issues>.
1687 Notes on multi-threading
1688 ------------------------
1690 For some systems, the OpenSSL `Configure` script knows what compiler options
1691 are needed to generate a library that is suitable for multi-threaded
1692 applications. On these systems, support for multi-threading is enabled
1693 by default; use the `no-threads` option to disable (this should never be
1696 On other systems, to enable support for multi-threading, you will have
1697 to specify at least two options: `threads`, and a system-dependent option.
1698 (The latter is `-D_REENTRANT` on various systems.) The default in this
1699 case, obviously, is not to include support for multi-threading (but
1700 you can still use `no-threads` to suppress an annoying warning message
1701 from the `Configure` script.)
1703 OpenSSL provides built-in support for two threading models: pthreads (found on
1704 most UNIX/Linux systems), and Windows threads. No other threading models are
1705 supported. If your platform does not provide pthreads or Windows threads then
1706 you should use `Configure` with the `no-threads` option.
1708 For pthreads, all locks are non-recursive. In addition, in a debug build,
1709 the mutex attribute `PTHREAD_MUTEX_ERRORCHECK` is used. If this is not
1710 available on your platform, you might have to add
1711 `-DOPENSSL_NO_MUTEX_ERRORCHECK` to your `Configure` invocation.
1712 (On Linux `PTHREAD_MUTEX_ERRORCHECK` is an enum value, so a built-in
1713 ifdef test cannot be used.)
1715 Notes on shared libraries
1716 -------------------------
1718 For most systems the OpenSSL `Configure` script knows what is needed to
1719 build shared libraries for libcrypto and libssl. On these systems
1720 the shared libraries will be created by default. This can be suppressed and
1721 only static libraries created by using the `no-shared` option. On systems
1722 where OpenSSL does not know how to build shared libraries the `no-shared`
1723 option will be forced and only static libraries will be created.
1725 Shared libraries are named a little differently on different platforms.
1726 One way or another, they all have the major OpenSSL version number as
1727 part of the file name, i.e. for OpenSSL 1.1.x, `1.1` is somehow part of
1730 On most POSIX platforms, shared libraries are named `libcrypto.so.1.1`
1731 and `libssl.so.1.1`.
1733 on Cygwin, shared libraries are named `cygcrypto-1.1.dll` and `cygssl-1.1.dll`
1734 with import libraries `libcrypto.dll.a` and `libssl.dll.a`.
1736 On Windows build with MSVC or using MingW, shared libraries are named
1737 `libcrypto-1_1.dll` and `libssl-1_1.dll` for 32-bit Windows,
1738 `libcrypto-1_1-x64.dll` and `libssl-1_1-x64.dll` for 64-bit x86_64 Windows,
1739 and `libcrypto-1_1-ia64.dll` and `libssl-1_1-ia64.dll` for IA64 Windows.
1740 With MSVC, the import libraries are named `libcrypto.lib` and `libssl.lib`,
1741 while with MingW, they are named `libcrypto.dll.a` and `libssl.dll.a`.
1743 On VMS, shareable images (VMS speak for shared libraries) are named
1744 `ossl$libcrypto0101_shr.exe` and `ossl$libssl0101_shr.exe`. However, when
1745 OpenSSL is specifically built for 32-bit pointers, the shareable images
1746 are named `ossl$libcrypto0101_shr32.exe` and `ossl$libssl0101_shr32.exe`
1747 instead, and when built for 64-bit pointers, they are named
1748 `ossl$libcrypto0101_shr64.exe` and `ossl$libssl0101_shr64.exe`.
1750 Notes on random number generation
1751 ---------------------------------
1753 Availability of cryptographically secure random numbers is required for
1754 secret key generation. OpenSSL provides several options to seed the
1755 internal CSPRNG. If not properly seeded, the internal CSPRNG will refuse
1756 to deliver random bytes and a "PRNG not seeded error" will occur.
1758 The seeding method can be configured using the `--with-rand-seed` option,
1759 which can be used to specify a comma separated list of seed methods.
1760 However, in most cases OpenSSL will choose a suitable default method,
1761 so it is not necessary to explicitly provide this option. Note also
1762 that not all methods are available on all platforms. The FIPS provider will
1763 silently ignore seed sources that were not validated.
1765 I) On operating systems which provide a suitable randomness source (in
1766 form of a system call or system device), OpenSSL will use the optimal
1767 available method to seed the CSPRNG from the operating system's
1768 randomness sources. This corresponds to the option `--with-rand-seed=os`.
1770 II) On systems without such a suitable randomness source, automatic seeding
1771 and reseeding is disabled (`--with-rand-seed=none`) and it may be necessary
1772 to install additional support software to obtain a random seed and reseed
1773 the CSPRNG manually. Please check out the manual pages for `RAND_add()`,
1774 `RAND_bytes()`, `RAND_egd()`, and the FAQ for more information.
1776 Notes on assembler modules compilation
1777 --------------------------------------
1779 Compilation of some code paths in assembler modules might depend on whether the
1780 current assembler version supports certain ISA extensions or not. Code paths
1781 that use the AES-NI, PCLMULQDQ, SSSE3, and SHA extensions are always assembled.
1782 Apart from that, the minimum requirements for the assembler versions are shown
1785 | ISA extension | GNU as | nasm | llvm |
1786 |---------------|--------|--------|---------|
1787 | AVX | 2.19 | 2.09 | 3.0 |
1788 | AVX2 | 2.22 | 2.10 | 3.1 |
1789 | ADCX/ADOX | 2.23 | 2.10 | 3.3 |
1790 | AVX512 | 2.25 | 2.11.8 | 3.6 (*) |
1791 | AVX512IFMA | 2.26 | 2.11.8 | 6.0 (*) |
1792 | VAES | 2.30 | 2.13.3 | 6.0 (*) |
1796 (*) Even though AVX512 support was implemented in llvm 3.6, prior to version 7.0
1797 an explicit -march flag was apparently required to compile assembly modules. But
1798 then the compiler generates processor-specific code, which in turn contradicts
1799 the idea of performing dispatch at run-time, which is facilitated by the special
1800 variable `OPENSSL_ia32cap`. For versions older than 7.0, it is possible to work
1801 around the problem by forcing the build procedure to use the following script:
1804 exec clang -no-integrated-as "$@"
1806 instead of the real clang. In which case it doesn't matter what clang version
1807 is used, as it is the version of the GNU assembler that will be checked.
1814 <https://mta.openssl.org/mailman/listinfo/openssl-users>
1820 <https://github.com/openssl/openssl/issues>
1823 <https://github.com/openssl/openssl/issues/new/choose>
1826 Configurations/10-main.conf