4 This document describes installation on all supported operating
5 systems (the Unix/Linux family, including macOS), OpenVMS,
11 - [Prerequisites](#prerequisites)
12 - [Notational Conventions](#notational-conventions)
13 - [Quick Installation Guide](#quick-installation-guide)
14 - [Building OpenSSL](#building-openssl)
15 - [Installing OpenSSL](#installing-openssl)
16 - [Configuration Options](#configuration-options)
17 - [API Level](#api-level)
18 - [Cross Compile Prefix](#cross-compile-prefix)
19 - [Build Type](#build-type)
20 - [Directories](#directories)
21 - [Compiler Warnings](#compiler-warnings)
22 - [Compression Algorithm Flags](#compression-algorithm-flags)
23 - [Seeding the Random Generator](#seeding-the-random-generator)
24 - [Setting the FIPS HMAC key](#setting-the-FIPS-HMAC-key)
25 - [Enable and Disable Features](#enable-and-disable-features)
26 - [Displaying configuration data](#displaying-configuration-data)
27 - [Installation Steps in Detail](#installation-steps-in-detail)
28 - [Configure](#configure-openssl)
29 - [Build](#build-openssl)
30 - [Test](#test-openssl)
31 - [Install](#install-openssl)
32 - [Advanced Build Options](#advanced-build-options)
33 - [Environment Variables](#environment-variables)
34 - [Makefile Targets](#makefile-targets)
35 - [Running Selected Tests](#running-selected-tests)
36 - [Troubleshooting](#troubleshooting)
37 - [Configuration Problems](#configuration-problems)
38 - [Build Failures](#build-failures)
39 - [Test Failures](#test-failures)
41 - [Notes on multi-threading](#notes-on-multi-threading)
42 - [Notes on shared libraries](#notes-on-shared-libraries)
43 - [Notes on random number generation](#notes-on-random-number-generation)
44 - [Notes on assembler modules compilation](#notes-on-assembler-modules-compilation)
49 To install OpenSSL, you will need:
51 * A "make" implementation
52 * Perl 5 with core modules (please read [NOTES-PERL.md](NOTES-PERL.md))
53 * The Perl module `Text::Template` (please read [NOTES-PERL.md](NOTES-PERL.md))
55 * a development environment in the form of development libraries and C
57 * a supported operating system
59 For additional platform specific requirements, solutions to specific
60 issues and other details, please read one of these:
62 * [Notes for UNIX-like platforms](NOTES-UNIX.md)
63 * [Notes for Android platforms](NOTES-ANDROID.md)
64 * [Notes for Windows platforms](NOTES-WINDOWS.md)
65 * [Notes for the DOS platform with DJGPP](NOTES-DJGPP.md)
66 * [Notes for the OpenVMS platform](NOTES-VMS.md)
67 * [Notes on Perl](NOTES-PERL.md)
68 * [Notes on Valgrind](NOTES-VALGRIND.md)
70 Notational conventions
71 ======================
73 Throughout this document, we use the following conventions.
78 Any line starting with a dollar sign is a command line.
82 The dollar sign indicates the shell prompt and is not to be entered as
88 Several words in curly braces separated by pipe characters indicate a
89 **mandatory choice**, to be replaced with one of the given words.
92 $ echo { WORD1 | WORD2 | WORD3 }
94 represents one of the following three commands
102 One or several words in square brackets separated by pipe characters
103 denote an **optional choice**. It is similar to the mandatory choice,
104 but it can also be omitted entirely.
108 $ echo [ WORD1 | WORD2 | WORD3 ]
110 represents one of the four commands
123 **Optional Arguments** are enclosed in square brackets.
127 A trailing ellipsis means that more than one could be specified.
129 Quick Installation Guide
130 ========================
132 If you just want to get OpenSSL installed without bothering too much
133 about the details, here is the short version of how to build and install
134 OpenSSL. If any of the following steps fails, please consult the
135 [Installation in Detail](#installation-steps-in-detail) section below.
140 Use the following commands to configure, build and test OpenSSL.
141 The testing is optional, but recommended if you intend to install
142 OpenSSL for production use.
144 ### Unix / Linux / macOS
152 Use the following commands to build OpenSSL:
160 If you are using Visual Studio, open a Developer Command Prompt and
161 issue the following commands to build OpenSSL.
167 As mentioned in the [Choices](#choices) section, you need to pick one
168 of the four Configure targets in the first command.
170 Most likely you will be using the `VC-WIN64A` target for 64bit Windows
171 binaries (AMD64) or `VC-WIN32` for 32bit Windows binaries (X86).
172 The other two options are `VC-WIN64I` (Intel IA64, Itanium) and
173 `VC-CE` (Windows CE) are rather uncommon nowadays.
178 The following commands will install OpenSSL to a default system location.
180 **Danger Zone:** even if you are impatient, please read the following two
181 paragraphs carefully before you install OpenSSL.
183 For security reasons the default system location is by default not writable
184 for unprivileged users. So for the final installation step administrative
185 privileges are required. The default system location and the procedure to
186 obtain administrative privileges depends on the operating system.
187 It is recommended to compile and test OpenSSL with normal user privileges
188 and use administrative privileges only for the final installation step.
190 On some platforms OpenSSL is preinstalled as part of the Operating System.
191 In this case it is highly recommended not to overwrite the system versions,
192 because other applications or libraries might depend on it.
193 To avoid breaking other applications, install your copy of OpenSSL to a
194 [different location](#installing-to-a-different-location) which is not in
195 the global search path for system libraries.
197 Finally, if you plan on using the FIPS module, you need to read the
198 [Post-installation Notes](#post-installation-notes) further down.
200 ### Unix / Linux / macOS
202 Depending on your distribution, you need to run the following command as
203 root user or prepend `sudo` to the command:
207 By default, OpenSSL will be installed to
211 More precisely, the files will be installed into the subdirectories
218 depending on the file type, as it is custom on Unix-like operating systems.
222 Use the following command to install OpenSSL.
226 By default, OpenSSL will be installed to
232 If you are using Visual Studio, open the Developer Command Prompt _elevated_
233 and issue the following command.
237 The easiest way to elevate the Command Prompt is to press and hold down
238 the both the `<CTRL>` and `<SHIFT>` key while clicking the menu item in the
241 The default installation location is
243 C:\Program Files\OpenSSL
245 for native binaries, or
247 C:\Program Files (x86)\OpenSSL
249 for 32bit binaries on 64bit Windows (WOW64).
251 #### Installing to a different location
253 To install OpenSSL to a different location (for example into your home
254 directory for testing purposes) run `Configure` as shown in the following
257 The options `--prefix` and `--openssldir` are explained in further detail in
258 [Directories](#directories) below, and the values used here are mere examples.
262 $ ./Configure --prefix=/opt/openssl --openssldir=/usr/local/ssl
266 $ perl Configure --prefix=PROGRAM:[INSTALLS] --openssldir=SYS$MANAGER:[OPENSSL]
268 Note: if you do add options to the configuration command, please make sure
269 you've read more than just this Quick Start, such as relevant `NOTES-*` files,
270 the options outline below, as configuration options may change the outcome
271 in otherwise unexpected ways.
273 Configuration Options
274 =====================
276 There are several options to `./Configure` to customize the build (note that
277 for Windows, the defaults for `--prefix` and `--openssldir` depend on what
278 configuration is used and what Windows implementation OpenSSL is built on.
279 For more information, see the [Notes for Windows platforms](NOTES-WINDOWS.md).
286 Build the OpenSSL libraries to support the API for the specified version.
287 If [no-deprecated](#no-deprecated) is also given, don't build with support
288 for deprecated APIs in or below the specified version number. For example,
291 --api=1.1.0 no-deprecated
293 will remove support for all APIs that were deprecated in OpenSSL version
294 1.1.0 or below. This is a rather specialized option for developers.
295 If you just intend to remove all deprecated APIs up to the current version
296 entirely, just specify [no-deprecated](#no-deprecated).
297 If `--api` isn't given, it defaults to the current (minor) OpenSSL version.
302 --cross-compile-prefix=<PREFIX>
304 The `<PREFIX>` to include in front of commands for your toolchain.
306 It is likely to have to end with dash, e.g. `a-b-c-` would invoke GNU compiler
307 as `a-b-c-gcc`, etc. Unfortunately cross-compiling is too case-specific to put
308 together one-size-fits-all instructions. You might have to pass more flags or
309 set up environment variables to actually make it work. Android and iOS cases
310 are discussed in corresponding `Configurations/15-*.conf` files. But there are
311 cases when this option alone is sufficient. For example to build the mingw64
312 target on Linux `--cross-compile-prefix=x86_64-w64-mingw32-` works. Naturally
313 provided that mingw packages are installed. Today Debian and Ubuntu users
314 have option to install a number of prepackaged cross-compilers along with
315 corresponding run-time and development packages for "alien" hardware. To give
316 another example `--cross-compile-prefix=mipsel-linux-gnu-` suffices in such
319 For cross compilation, you must [configure manually](#manual-configuration).
320 Also, note that `--openssldir` refers to target's file system, not one you are
328 Build OpenSSL with debugging symbols and zero optimization level.
332 Build OpenSSL without debugging symbols. This is the default.
341 The name of the directory under the top of the installation directory tree
342 (see the `--prefix` option) where libraries will be installed. By default
343 this is `lib`. Note that on Windows only static libraries (`*.lib`) will
344 be stored in this location. Shared libraries (`*.dll`) will always be
345 installed to the `bin` directory.
347 Some build targets have a multilib postfix set in the build configuration.
348 For these targets the default libdir is `lib<multilib-postfix>`. Please use
349 `--libdir=lib` to override the libdir if adding the postfix is undesirable.
355 Directory for OpenSSL configuration files, and also the default certificate
356 and key store. Defaults are:
359 Windows: C:\Program Files\Common Files\SSL
360 OpenVMS: SYS$COMMON:[OPENSSL-COMMON]
362 For 32bit Windows applications on Windows 64bit (WOW64), always replace
363 `C:\Program Files` by `C:\Program Files (x86)`.
369 The top of the installation directory tree. Defaults are:
372 Windows: C:\Program Files\OpenSSL
373 OpenVMS: SYS$COMMON:[OPENSSL]
380 This is a developer flag that switches on various compiler options recommended
381 for OpenSSL development. It only works when using gcc or clang as the compiler.
382 If you are developing a patch for OpenSSL then it is recommended that you use
383 this option where possible.
385 Compression Algorithm Flags
386 ---------------------------
388 ### with-brotli-include
390 --with-brotli-include=DIR
392 The directory for the location of the brotli include files (i.e. the location
393 of the **brotli** include directory). This option is only necessary if
394 [enable-brotli](#enable-brotli) is used and the include files are not already
395 on the system include path.
399 --with-brotli-lib=LIB
401 **On Unix**: this is the directory containing the brotli libraries.
402 If not provided, the system library path will be used.
404 The names of the libraries are:
406 * libbrotlicommon.a or libbrotlicommon.so
407 * libbrotlidec.a or libbrotlidec.so
408 * libbrotlienc.a or libbrotlienc.so
410 **On Windows:** this is the directory containing the brotli libraries.
411 If not provided, the system library path will be used.
413 The names of the libraries are:
419 ### with-zlib-include
421 --with-zlib-include=DIR
423 The directory for the location of the zlib include file. This option is only
424 necessary if [zlib](#zlib) is used and the include file is not
425 already on the system include path.
431 **On Unix**: this is the directory containing the zlib library.
432 If not provided the system library path will be used.
434 **On Windows:** this is the filename of the zlib library (with or
435 without a path). This flag must be provided if the
436 [zlib-dynamic](#zlib-dynamic) option is not also used. If `zlib-dynamic` is used
437 then this flag is optional and defaults to `ZLIB1` if not provided.
439 **On VMS:** this is the filename of the zlib library (with or without a path).
440 This flag is optional and if not provided then `GNV$LIBZSHR`, `GNV$LIBZSHR32`
441 or `GNV$LIBZSHR64` is used by default depending on the pointer size chosen.
443 ### with-zstd-include
445 --with-zstd-include=DIR
447 The directory for the location of the Zstd include file. This option is only
448 necessary if [enable-std](#enable-zstd) is used and the include file is not
449 already on the system include path.
451 OpenSSL requires Zstd 1.4 or greater. The Linux kernel source contains a
452 *zstd.h* file that is not compatible with the 1.4.x Zstd distribution, the
453 compilation will generate an error if the Linux *zstd.h* is included before
454 (or instead of) the Zstd distribution header.
460 **On Unix**: this is the directory containing the Zstd library.
461 If not provided the system library path will be used.
463 **On Windows:** this is the filename of the Zstd library (with or
464 without a path). This flag must be provided if the
465 [enable-zstd-dynamic](#enable-zstd-dynamic) option is not also used.
466 If `zstd-dynamic` is used then this flag is optional and defaults
467 to `LIBZSTD` if not provided.
469 Seeding the Random Generator
470 ----------------------------
472 --with-rand-seed=seed1[,seed2,...]
474 A comma separated list of seeding methods which will be tried by OpenSSL
475 in order to obtain random input (a.k.a "entropy") for seeding its
476 cryptographically secure random number generator (CSPRNG).
477 The current seeding methods are:
481 Use a trusted operating system entropy source.
482 This is the default method if such an entropy source exists.
486 Use the [getrandom(2)][man-getrandom] or equivalent system call.
488 [man-getrandom]: http://man7.org/linux/man-pages/man2/getrandom.2.html
492 Use the first device from the `DEVRANDOM` list which can be opened to read
493 random bytes. The `DEVRANDOM` preprocessor constant expands to
495 "/dev/urandom","/dev/random","/dev/srandom"
497 on most unix-ish operating systems.
501 Check for an entropy generating daemon.
502 This source is ignored by the FIPS provider.
506 Use the `RDSEED` or `RDRAND` command on x86 or `RNDRRS` command on aarch64
507 if provided by the CPU.
511 Use librandom (not implemented yet).
512 This source is ignored by the FIPS provider.
516 Disable automatic seeding. This is the default on some operating systems where
517 no suitable entropy source exists, or no support for it is implemented yet.
518 This option is ignored by the FIPS provider.
520 For more information, see the section [Notes on random number generation][rng]
521 at the end of this document.
523 [rng]: #notes-on-random-number-generation
525 Setting the FIPS HMAC key
526 -------------------------
530 As part of its self-test validation, the FIPS module must verify itself
531 by performing a SHA-256 HMAC computation on itself. The default key is
532 the SHA256 value of "the holy handgrenade of antioch" and is sufficient
533 for meeting the FIPS requirements.
535 To change the key to a different value, use this flag. The value should
536 be a hex string no more than 64 characters.
538 Enable and Disable Features
539 ---------------------------
541 Feature options always come in pairs, an option to enable feature
542 `xxxx`, and an option to disable it:
544 [ enable-xxxx | no-xxxx ]
546 Whether a feature is enabled or disabled by default, depends on the feature.
547 In the following list, always the non-default variant is documented: if
548 feature `xxxx` is disabled by default then `enable-xxxx` is documented and
549 if feature `xxxx` is enabled by default then `no-xxxx` is documented.
553 Don't build the AFALG engine.
555 This option will be forced on a platform that does not support AFALG.
559 Build with Kernel TLS support.
561 This option will enable the use of the Kernel TLS data-path, which can improve
562 performance and allow for the use of sendfile and splice system calls on
563 TLS sockets. The Kernel may use TLS accelerators if any are available on the
564 system. This option will be forced off on systems that do not support the
565 Kernel TLS data-path.
569 Build with the Address sanitiser.
571 This is a developer option only. It may not work on all platforms and should
572 never be used in production environments. It will only work when used with
573 gcc or clang and should be used in conjunction with the [no-shared](#no-shared)
576 ### enable-acvp-tests
578 Build support for Automated Cryptographic Validation Protocol (ACVP)
581 This is required for FIPS validation purposes. Certain ACVP tests require
582 access to algorithm internals that are not normally accessible.
583 Additional information related to ACVP can be found at
584 <https://github.com/usnistgov/ACVP>.
588 Do not use assembler code.
590 This should be viewed as debugging/troubleshooting option rather than for
591 production use. On some platforms a small amount of assembler code may still
592 be used even with this option.
596 Do not build support for async operations.
600 Don't automatically load all supported ciphers and digests.
602 Typically OpenSSL will make available all of its supported ciphers and digests.
603 For a statically linked application this may be undesirable if small executable
604 size is an objective. This only affects libcrypto. Ciphers and digests will
605 have to be loaded manually using `EVP_add_cipher()` and `EVP_add_digest()`
606 if this option is used. This option will force a non-shared build.
610 Don't automatically load all libcrypto/libssl error strings.
612 Typically OpenSSL will automatically load human readable error strings. For a
613 statically linked application this may be undesirable if small executable size
618 Build with support for brotli compression/decompression.
620 ### enable-brotli-dynamic
622 Like the enable-brotli option, but has OpenSSL load the brotli library dynamically
625 This is only supported on systems where loading of shared libraries is supported.
627 ### no-autoload-config
629 Don't automatically load the default `openssl.cnf` file.
631 Typically OpenSSL will automatically load a system config file which configures
634 ### enable-buildtest-c++
636 While testing, generate C++ buildtest files that simply check that the public
637 OpenSSL header files are usable standalone with C++.
639 Enabling this option demands extra care. For any compiler flag given directly
640 as configuration option, you must ensure that it's valid for both the C and
641 the C++ compiler. If not, the C++ build test will most likely break. As an
642 alternative, you can use the language specific variables, `CFLAGS` and `CXXFLAGS`.
646 Use the specified text instead of the default banner at the end of
651 On platforms where the choice of 32-bit or 64-bit architecture
652 is not explicitly specified, `Configure` will print a warning
653 message and wait for a few seconds to let you interrupt the
654 configuration. Using this flag skips the wait.
658 Build only some minimal set of features.
659 This is a developer option used internally for CI build tests of the project.
663 Never cache algorithms when they are fetched from a provider. Normally, a
664 provider indicates if the algorithms it supplies can be cached or not. Using
665 this option will reduce run-time memory usage but it also introduces a
666 significant performance penalty. This option is primarily designed to help
667 with detecting incorrect reference counting.
671 Don't build the CAPI engine.
673 This option will be forced if on a platform that does not support CAPI.
677 Don't build support for Certificate Management Protocol (CMP)
678 and Certificate Request Message Format (CRMF).
682 Don't build support for Cryptographic Message Syntax (CMS).
686 Don't build support for SSL/TLS compression.
688 If this option is enabled (the default), then compression will only work if
689 the zlib or `zlib-dynamic` options are also chosen.
691 ### enable-crypto-mdebug
693 This now only enables the `failed-malloc` feature.
695 ### enable-crypto-mdebug-backtrace
697 This is a no-op; the project uses the compiler's address/leak sanitizer instead.
701 Don't build support for Certificate Transparency (CT).
705 Don't build with support for deprecated APIs up until and including the version
706 given with `--api` (or the current version, if `--api` wasn't specified).
710 Don't build support for datagram based BIOs.
712 Selecting this option will also force the disabling of DTLS.
716 Don't build support for loading Dynamic Shared Objects (DSO)
718 ### enable-devcryptoeng
720 Build the `/dev/crypto` engine.
722 This option is automatically selected on the BSD platform, in which case it can
723 be disabled with `no-devcryptoeng`.
725 ### no-dynamic-engine
727 Don't build the dynamically loaded engines.
729 This only has an effect in a shared build.
733 Don't build support for Elliptic Curves.
737 Don't build support for binary Elliptic Curves
739 ### enable-ec_nistp_64_gcc_128
741 Enable support for optimised implementations of some commonly used NIST
744 This option is only supported on platforms:
746 - with little-endian storage of non-byte types
747 - that tolerate misaligned memory references
748 - where the compiler:
749 - supports the non-standard type `__uint128_t`
750 - defines the built-in macro `__SIZEOF_INT128__`
754 Build support for gathering entropy from the Entropy Gathering Daemon (EGD).
758 Don't build support for loading engines.
762 Don't compile in any error strings.
764 ### enable-external-tests
766 Enable building of integration with external test suites.
768 This is a developer option and may not work on all platforms. The following
769 external test suites are currently supported:
771 - GOST engine test suite
772 - Python PYCA/Cryptography test suite
775 See the file [test/README-external.md](test/README-external.md)
780 Don't compile in filename and line number information (e.g. for errors and
785 Build (and install) the FIPS provider
787 ### no-fips-securitychecks
789 Don't perform FIPS module run-time checks related to enforcement of security
790 parameters such as minimum security strength of keys.
792 ### enable-fuzz-libfuzzer, enable-fuzz-afl
794 Build with support for fuzzing using either libfuzzer or AFL.
796 These are developer options only. They may not work on all platforms and
797 should never be used in production environments.
799 See the file [fuzz/README.md](fuzz/README.md) for further details.
803 Don't build support for GOST based ciphersuites.
805 Note that if this feature is enabled then GOST ciphersuites are only available
806 if the GOST algorithms are also available through loading an externally supplied
811 Don't build the legacy provider.
813 Disabling this also disables the legacy algorithms: MD2 (already disabled by default).
817 Don't generate dependencies.
821 Don't build any dynamically loadable engines.
823 This also implies `no-dynamic-engine`.
827 Don't build support for writing multiple records in one go in libssl
829 Note: this is a different capability to the pipelining functionality.
833 Don't build support for the Next Protocol Negotiation (NPN) TLS extension.
837 Don't build support for Online Certificate Status Protocol (OCSP).
841 Don't build the padlock engine.
845 As synonym for `no-padlockeng`. Deprecated and should not be used.
849 Don't build with support for Position Independent Code.
853 Don't pin the shared libraries.
855 By default OpenSSL will attempt to stay in memory until the process exits.
856 This is so that libcrypto and libssl can be properly cleaned up automatically
857 via an `atexit()` handler. The handler is registered by libcrypto and cleans
858 up both libraries. On some platforms the `atexit()` handler will run on unload of
859 libcrypto (if it has been dynamically loaded) rather than at process exit. This
860 option can be used to stop OpenSSL from attempting to stay in memory until the
861 process exits. This could lead to crashes if either libcrypto or libssl have
862 already been unloaded at the point that the atexit handler is invoked, e.g. on a
863 platform which calls `atexit()` on unload of the library, and libssl is unloaded
864 before libcrypto then a crash is likely to happen. Applications can suppress
865 running of the `atexit()` handler at run time by using the
866 `OPENSSL_INIT_NO_ATEXIT` option to `OPENSSL_init_crypto()`.
867 See the man page for it for further details.
871 Don't use POSIX IO capabilities.
875 Don't build support for Pre-Shared Key based ciphersuites.
879 Don't use hardware RDRAND capabilities.
883 Don't build support for RFC3779, "X.509 Extensions for IP Addresses and
888 Build support for Stream Control Transmission Protocol (SCTP).
892 Do not create shared libraries, only static ones.
894 See [Notes on shared libraries](#notes-on-shared-libraries) below.
898 Don't build support for socket BIOs.
902 Don't build support for Secure Remote Password (SRP) protocol or
903 SRP based ciphersuites.
907 Don't build Secure Real-Time Transport Protocol (SRTP) support.
911 Exclude SSE2 code paths from 32-bit x86 assembly modules.
913 Normally SSE2 extension is detected at run-time, but the decision whether or not
914 the machine code will be executed is taken solely on CPU capability vector. This
915 means that if you happen to run OS kernel which does not support SSE2 extension
916 on Intel P4 processor, then your application might be exposed to "illegal
917 instruction" exception. There might be a way to enable support in kernel, e.g.
918 FreeBSD kernel can be compiled with `CPU_ENABLE_SSE`, and there is a way to
919 disengage SSE2 code paths upon application start-up, but if you aim for wider
920 "audience" running such kernel, consider `no-sse2`. Both the `386` and `no-asm`
921 options imply `no-sse2`.
925 Don't build with SSL Trace capabilities.
927 This removes the `-trace` option from `s_client` and `s_server`, and omits the
928 `SSL_trace()` function from libssl.
930 Disabling `ssl-trace` may provide a small reduction in libssl binary size.
934 Don't build the statically linked engines.
936 This only has an impact when not built "shared".
940 Don't use anything from the C header file `stdio.h` that makes use of the `FILE`
941 type. Only libcrypto and libssl can be built in this way. Using this option will
942 suppress building the command line applications. Additionally, since the OpenSSL
943 tests also use the command line applications, the tests will also be skipped.
947 Don't build test programs or run any tests.
951 Build with support for TCP Fast Open (RFC7413). Supported on Linux, macOS and FreeBSD.
955 Build with QUIC support. This is currently just for developers as the
956 implementation is by no means complete and usable.
960 Don't build with support for multi-threaded applications.
964 Build with support for multi-threaded applications. Most platforms will enable
965 this by default. However, if on a platform where this is not the case then this
966 will usually require additional system-dependent options!
968 See [Notes on multi-threading](#notes-on-multi-threading) below.
972 Don't build with support for thread pool functionality.
976 Build with thread pool functionality. If enabled, OpenSSL algorithms may
977 use the thread pool to perform parallel computation. This option in itself
978 does not enable OpenSSL to spawn new threads. Currently the only supported
979 thread pool mechanism is the default thread pool.
981 ### no-default-thread-pool
983 Don't build with support for default thread pool functionality.
985 ### default-thread-pool
987 Build with default thread pool functionality. If enabled, OpenSSL may create
988 and manage threads up to a maximum number of threads authorized by the
989 application. Supported on POSIX compliant platforms and Windows.
993 Build with support for the integrated tracing api.
995 See manual pages OSSL_trace_set_channel(3) and OSSL_trace_enabled(3) for details.
999 Don't build Time Stamping (TS) Authority support.
1003 Build with the Undefined Behaviour sanitiser (UBSAN).
1005 This is a developer option only. It may not work on all platforms and should
1006 never be used in production environments. It will only work when used with
1007 gcc or clang and should be used in conjunction with the `-DPEDANTIC` option
1008 (or the `--strict-warnings` option).
1012 Don't build with the User Interface (UI) console method
1014 The User Interface console method enables text based console prompts.
1016 ### enable-unit-test
1018 Enable additional unit test APIs.
1020 This should not typically be used in production deployments.
1024 Don't build support for UPLINK interface.
1026 ### enable-weak-ssl-ciphers
1028 Build support for SSL/TLS ciphers that are considered "weak"
1030 Enabling this includes for example the RC4 based ciphersuites.
1034 Build with support for zlib compression/decompression.
1038 Like the zlib option, but has OpenSSL load the zlib library dynamically
1041 This is only supported on systems where loading of shared libraries is supported.
1045 Build with support for Zstd compression/decompression.
1047 ### enable-zstd-dynamic
1049 Like the enable-zstd option, but has OpenSSL load the Zstd library dynamically
1052 This is only supported on systems where loading of shared libraries is supported.
1056 In 32-bit x86 builds, use the 80386 instruction set only in assembly modules
1058 The default x86 code is more efficient, but requires at least an 486 processor.
1059 Note: This doesn't affect compiler generated code, so this option needs to be
1060 accompanied by a corresponding compiler-specific option.
1064 no-{ssl|ssl3|tls|tls1|tls1_1|tls1_2|tls1_3|dtls|dtls1|dtls1_2}
1066 Don't build support for negotiating the specified SSL/TLS protocol.
1068 If `no-tls` is selected then all of `tls1`, `tls1_1`, `tls1_2` and `tls1_3`
1070 Similarly `no-dtls` will disable `dtls1` and `dtls1_2`. The `no-ssl` option is
1071 synonymous with `no-ssl3`. Note this only affects version negotiation.
1072 OpenSSL will still provide the methods for applications to explicitly select
1073 the individual protocol versions.
1075 ### no-{protocol}-method
1077 no-{ssl3|tls1|tls1_1|tls1_2|dtls1|dtls1_2}-method
1079 Analogous to `no-{protocol}` but in addition do not build the methods for
1080 applications to explicitly select individual protocol versions. Note that there
1081 is no `no-tls1_3-method` option because there is no application method for
1084 Using individual protocol methods directly is deprecated. Applications should
1085 use `TLS_method()` instead.
1087 ### enable-{algorithm}
1091 Build with support for the specified algorithm.
1095 no-{aria|bf|blake2|camellia|cast|chacha|cmac|
1096 des|dh|dsa|ecdh|ecdsa|idea|md4|mdc2|ocb|
1097 poly1305|rc2|rc4|rmd160|scrypt|seed|
1098 siphash|siv|sm2|sm3|sm4|whirlpool}
1100 Build without support for the specified algorithm.
1102 The `ripemd` algorithm is deprecated and if used is synonymous with `rmd160`.
1104 ### Compiler-specific options
1106 -Dxxx, -Ixxx, -Wp, -lxxx, -Lxxx, -Wl, -rpath, -R, -framework, -static
1108 These system specific options will be recognised and passed through to the
1109 compiler to allow you to define preprocessor symbols, specify additional
1110 libraries, library directories or other compiler options. It might be worth
1111 noting that some compilers generate code specifically for processor the
1112 compiler currently executes on. This is not necessarily what you might have
1113 in mind, since it might be unsuitable for execution on other, typically older,
1114 processor. Consult your compiler documentation.
1116 Take note of the [Environment Variables](#environment-variables) documentation
1117 below and how these flags interact with those variables.
1121 Additional options that are not otherwise recognised are passed through as
1122 they are to the compiler as well. Unix-style options beginning with a
1123 `-` or `+` and Windows-style options beginning with a `/` are recognised.
1124 Again, consult your compiler documentation.
1126 If the option contains arguments separated by spaces, then the URL-style
1127 notation `%20` can be used for the space character in order to avoid having
1128 to quote the option. For example, `-opt%20arg` gets expanded to `-opt arg`.
1129 In fact, any ASCII character can be encoded as %xx using its hexadecimal
1132 Take note of the [Environment Variables](#environment-variables) documentation
1133 below and how these flags interact with those variables.
1135 ### Environment Variables
1139 Assign the given value to the environment variable `VAR` for `Configure`.
1141 These work just like normal environment variable assignments, but are supported
1142 on all platforms and are confined to the configuration scripts only.
1143 These assignments override the corresponding value in the inherited environment,
1146 The following variables are used as "`make` variables" and can be used as an
1147 alternative to giving preprocessor, compiler and linker options directly as
1148 configuration. The following variables are supported:
1150 AR The static library archiver.
1151 ARFLAGS Flags for the static library archiver.
1152 AS The assembler compiler.
1153 ASFLAGS Flags for the assembler compiler.
1155 CFLAGS Flags for the C compiler.
1156 CXX The C++ compiler.
1157 CXXFLAGS Flags for the C++ compiler.
1158 CPP The C/C++ preprocessor.
1159 CPPFLAGS Flags for the C/C++ preprocessor.
1160 CPPDEFINES List of CPP macro definitions, separated
1161 by a platform specific character (':' or
1162 space for Unix, ';' for Windows, ',' for
1163 VMS). This can be used instead of using
1164 -D (or what corresponds to that on your
1165 compiler) in CPPFLAGS.
1166 CPPINCLUDES List of CPP inclusion directories, separated
1167 the same way as for CPPDEFINES. This can
1168 be used instead of -I (or what corresponds
1169 to that on your compiler) in CPPFLAGS.
1170 HASHBANGPERL Perl invocation to be inserted after '#!'
1171 in public perl scripts (only relevant on
1173 LD The program linker (not used on Unix, $(CC)
1175 LDFLAGS Flags for the shared library, DSO and
1177 LDLIBS Extra libraries to use when linking.
1178 Takes the form of a space separated list
1179 of library specifications on Unix and
1180 Windows, and as a comma separated list of
1182 RANLIB The library archive indexer.
1183 RC The Windows resource compiler.
1184 RCFLAGS Flags for the Windows resource compiler.
1185 RM The command to remove files and directories.
1187 These cannot be mixed with compiling/linking flags given on the command line.
1188 In other words, something like this isn't permitted.
1190 $ ./Configure -DFOO CPPFLAGS=-DBAR -DCOOKIE
1192 Backward compatibility note:
1194 To be compatible with older configuration scripts, the environment variables
1195 are ignored if compiling/linking flags are given on the command line, except
1198 AR, CC, CXX, CROSS_COMPILE, HASHBANGPERL, PERL, RANLIB, RC, and WINDRES
1200 For example, the following command will not see `-DBAR`:
1202 $ CPPFLAGS=-DBAR ./Configure -DCOOKIE
1204 However, the following will see both set variables:
1206 $ CC=gcc CROSS_COMPILE=x86_64-w64-mingw32- ./Configure -DCOOKIE
1208 If `CC` is set, it is advisable to also set `CXX` to ensure both the C and C++
1209 compiler are in the same "family". This becomes relevant with
1210 `enable-external-tests` and `enable-buildtest-c++`.
1217 Reconfigure from earlier data.
1219 This fetches the previous command line options and environment from data
1220 saved in `configdata.pm` and runs the configuration process again, using
1221 these options and environment. Note: NO other option is permitted together
1222 with `reconf`. Note: The original configuration saves away values for ALL
1223 environment variables that were used, and if they weren't defined, they are
1224 still saved away with information that they weren't originally defined.
1225 This information takes precedence over environment variables that are
1226 defined when reconfiguring.
1228 Displaying configuration data
1229 -----------------------------
1231 The configuration script itself will say very little, and finishes by
1232 creating `configdata.pm`. This perl module can be loaded by other scripts
1233 to find all the configuration data, and it can also be used as a script to
1234 display all sorts of configuration data in a human readable form.
1236 For more information, please do:
1238 $ ./configdata.pm --help # Unix
1242 $ perl configdata.pm --help # Windows and VMS
1244 Installation Steps in Detail
1245 ============================
1250 ### Automatic Configuration
1252 In previous version, the `config` script determined the platform type and
1253 compiler and then called `Configure`. Starting with this release, they are
1256 #### Unix / Linux / macOS
1258 $ ./Configure [options...]
1262 $ perl Configure [options...]
1266 $ perl Configure [options...]
1268 ### Manual Configuration
1270 OpenSSL knows about a range of different operating system, hardware and
1271 compiler combinations. To see the ones it knows about, run
1273 $ ./Configure LIST # Unix
1277 $ perl Configure LIST # All other platforms
1279 For the remainder of this text, the Unix form will be used in all examples.
1280 Please use the appropriate form for your platform.
1282 Pick a suitable name from the list that matches your system. For most
1283 operating systems there is a choice between using cc or gcc.
1284 When you have identified your system (and if necessary compiler) use this
1285 name as the argument to `Configure`. For example, a `linux-elf` user would
1288 $ ./Configure linux-elf [options...]
1290 ### Creating your own Configuration
1292 If your system isn't listed, you will have to create a configuration
1293 file named `Configurations/YOURFILENAME.conf` (replace `YOURFILENAME`
1294 with a filename of your choosing) and add the correct
1295 configuration for your system. See the available configs as examples
1296 and read [Configurations/README.md](Configurations/README.md) and
1297 [Configurations/README-design.md](Configurations/README-design.md)
1298 for more information.
1300 The generic configurations `cc` or `gcc` should usually work on 32 bit
1303 `Configure` creates a build file (`Makefile` on Unix, `makefile` on Windows
1304 and `descrip.mms` on OpenVMS) from a suitable template in `Configurations/`,
1305 and defines various macros in `include/openssl/configuration.h` (generated
1306 from `include/openssl/configuration.h.in`.
1308 ### Out of Tree Builds
1310 OpenSSL can be configured to build in a build directory separate from the
1311 source code directory. It's done by placing yourself in some other
1312 directory and invoking the configuration commands from there.
1316 $ mkdir /var/tmp/openssl-build
1317 $ cd /var/tmp/openssl-build
1318 $ /PATH/TO/OPENSSL/SOURCE/Configure [options...]
1320 #### OpenVMS example
1322 $ set default sys$login:
1323 $ create/dir [.tmp.openssl-build]
1324 $ set default [.tmp.openssl-build]
1325 $ perl D:[PATH.TO.OPENSSL.SOURCE]Configure [options...]
1327 #### Windows example
1330 $ mkdir \temp-openssl
1332 $ perl d:\PATH\TO\OPENSSL\SOURCE\Configure [options...]
1334 Paths can be relative just as well as absolute. `Configure` will do its best
1335 to translate them to relative paths whenever possible.
1340 Build OpenSSL by running:
1343 $ mms ! (or mmk) OpenVMS
1346 This will build the OpenSSL libraries (`libcrypto.a` and `libssl.a` on
1347 Unix, corresponding on other platforms) and the OpenSSL binary
1348 (`openssl`). The libraries will be built in the top-level directory,
1349 and the binary will be in the `apps/` subdirectory.
1351 If the build fails, take a look at the [Build Failures](#build-failures)
1352 subsection of the [Troubleshooting](#troubleshooting) section.
1357 After a successful build, and before installing, the libraries should
1361 $ mms test ! OpenVMS
1362 $ nmake test # Windows
1364 **Warning:** you MUST run the tests from an unprivileged account (or disable
1365 your privileges temporarily if your platform allows it).
1367 See [test/README.md](test/README.md) for further details how run tests.
1369 See [test/README-dev.md](test/README-dev.md) for guidelines on adding tests.
1374 If everything tests ok, install OpenSSL with
1376 $ make install # Unix
1377 $ mms install ! OpenVMS
1378 $ nmake install # Windows
1380 Note that in order to perform the install step above you need to have
1381 appropriate permissions to write to the installation directory.
1383 The above commands will install all the software components in this
1384 directory tree under `<PREFIX>` (the directory given with `--prefix` or
1387 ### Unix / Linux / macOS
1389 bin/ Contains the openssl binary and a few other
1392 Contains the header files needed if you want
1393 to build your own programs that use libcrypto
1395 lib Contains the OpenSSL library files.
1396 lib/engines Contains the OpenSSL dynamically loadable engines.
1398 share/man/man1 Contains the OpenSSL command line man-pages.
1399 share/man/man3 Contains the OpenSSL library calls man-pages.
1400 share/man/man5 Contains the OpenSSL configuration format man-pages.
1401 share/man/man7 Contains the OpenSSL other misc man-pages.
1403 share/doc/openssl/html/man1
1404 share/doc/openssl/html/man3
1405 share/doc/openssl/html/man5
1406 share/doc/openssl/html/man7
1407 Contains the HTML rendition of the man-pages.
1411 'arch' is replaced with the architecture name, `ALPHA` or `IA64`,
1412 'sover' is replaced with the shared library version (`0101` for 1.1), and
1413 'pz' is replaced with the pointer size OpenSSL was built with:
1415 [.EXE.'arch'] Contains the openssl binary.
1416 [.EXE] Contains a few utility scripts.
1418 Contains the header files needed if you want
1419 to build your own programs that use libcrypto
1421 [.LIB.'arch'] Contains the OpenSSL library files.
1422 [.ENGINES'sover''pz'.'arch']
1423 Contains the OpenSSL dynamically loadable engines.
1424 [.SYS$STARTUP] Contains startup, login and shutdown scripts.
1425 These define appropriate logical names and
1427 [.SYSTEST] Contains the installation verification procedure.
1428 [.HTML] Contains the HTML rendition of the manual pages.
1430 ### Additional Directories
1432 Additionally, install will add the following directories under
1433 OPENSSLDIR (the directory given with `--openssldir` or its default)
1434 for you convenience:
1436 certs Initially empty, this is the default location
1437 for certificate files.
1438 private Initially empty, this is the default location
1439 for private key files.
1440 misc Various scripts.
1442 The installation directory should be appropriately protected to ensure
1443 unprivileged users cannot make changes to OpenSSL binaries or files, or
1444 install engines. If you already have a pre-installed version of OpenSSL as
1445 part of your Operating System it is recommended that you do not overwrite
1446 the system version and instead install to somewhere else.
1448 Package builders who want to configure the library for standard locations,
1449 but have the package installed somewhere else so that it can easily be
1452 $ make DESTDIR=/tmp/package-root install # Unix
1453 $ mms/macro="DESTDIR=TMP:[PACKAGE-ROOT]" install ! OpenVMS
1455 The specified destination directory will be prepended to all installation
1458 Compatibility issues with previous OpenSSL versions
1459 ---------------------------------------------------
1461 ### COMPILING existing applications
1463 Starting with version 1.1.0, OpenSSL hides a number of structures that were
1464 previously open. This includes all internal libssl structures and a number
1465 of EVP types. Accessor functions have been added to allow controlled access
1466 to the structures' data.
1468 This means that some software needs to be rewritten to adapt to the new ways
1469 of doing things. This often amounts to allocating an instance of a structure
1470 explicitly where you could previously allocate them on the stack as automatic
1471 variables, and using the provided accessor functions where you would previously
1472 access a structure's field directly.
1474 Some APIs have changed as well. However, older APIs have been preserved when
1477 Post-installation Notes
1478 -----------------------
1480 With the default OpenSSL installation comes a FIPS provider module, which
1481 needs some post-installation attention, without which it will not be usable.
1482 This involves using the following command:
1484 $ openssl fipsinstall
1486 See the openssl-fipsinstall(1) manual for details and examples.
1488 Advanced Build Options
1489 ======================
1491 Environment Variables
1492 ---------------------
1494 A number of environment variables can be used to provide additional control
1495 over the build process. Typically these should be defined prior to running
1496 `Configure`. Not all environment variables are relevant to all platforms.
1499 The name of the ar executable to use.
1502 Use a different build file name than the platform default
1503 ("Makefile" on Unix-like platforms, "makefile" on native Windows,
1504 "descrip.mms" on OpenVMS). This requires that there is a
1505 corresponding build file template.
1506 See [Configurations/README.md](Configurations/README.md)
1507 for further information.
1510 The compiler to use. Configure will attempt to pick a default
1511 compiler for your platform but this choice can be overridden
1512 using this variable. Set it to the compiler executable you wish
1513 to use, e.g. gcc or clang.
1516 This environment variable has the same meaning as for the
1517 "--cross-compile-prefix" Configure flag described above. If both
1518 are set then the Configure flag takes precedence.
1521 The command string for the Perl executable to insert in the
1522 #! line of perl scripts that will be publicly installed.
1523 Default: /usr/bin/env perl
1524 Note: the value of this variable is added to the same scripts
1525 on all platforms, but it's only relevant on Unix-like platforms.
1528 This can be the value `32` or `64` to specify the architecture
1529 when it is not "obvious" to the configuration. It should generally
1530 not be necessary to specify this environment variable.
1533 The name of the nm executable to use.
1535 OPENSSL_LOCAL_CONFIG_DIR
1536 OpenSSL comes with a database of information about how it
1537 should be built on different platforms as well as build file
1538 templates for those platforms. The database is comprised of
1539 ".conf" files in the Configurations directory. The build
1540 file templates reside there as well as ".tmpl" files. See the
1541 file [Configurations/README.md](Configurations/README.md)
1542 for further information about the format of ".conf" files
1543 as well as information on the ".tmpl" files.
1544 In addition to the standard ".conf" and ".tmpl" files, it is
1545 possible to create your own ".conf" and ".tmpl" files and
1546 store them locally, outside the OpenSSL source tree.
1547 This environment variable can be set to the directory where
1548 these files are held and will be considered by Configure
1549 before it looks in the standard directories.
1552 The name of the Perl executable to use when building OpenSSL.
1553 Only needed if builing should use a different Perl executable
1554 than what is used to run the Configure script.
1557 The name of the ranlib executable to use.
1560 The name of the rc executable to use. The default will be as
1561 defined for the target platform in the ".conf" file. If not
1562 defined then "windres" will be used. The WINDRES environment
1563 variable is synonymous to this. If both are defined then RC
1572 The `Configure` script generates a Makefile in a format relevant to the specific
1573 platform. The Makefiles provide a number of targets that can be used. Not all
1574 targets may be available on all platforms. Only the most common targets are
1575 described here. Examine the Makefiles themselves for the full list.
1578 The target to build all the software components and
1582 Build all the software components.
1583 THIS IS THE DEFAULT TARGET.
1586 Build all documentation components.
1589 Remove all build artefacts and return the directory to a "clean"
1593 Rebuild the dependencies in the Makefiles. This is a legacy
1594 option that no longer needs to be used since OpenSSL 1.1.0.
1597 Install all OpenSSL components.
1600 Only install the OpenSSL software components.
1603 Only install the OpenSSL documentation components.
1606 Only install the OpenSSL man pages (Unix only).
1609 Only install the OpenSSL HTML documentation.
1612 Install the FIPS provider module configuration file.
1615 Prints a list of all the self test names.
1618 Build and run the OpenSSL self tests.
1621 Uninstall all OpenSSL components.
1625 Re-run the configuration process, as exactly as the last time
1629 This is a developer option. If you are developing a patch for
1630 OpenSSL you may need to use this if you want to update
1631 automatically generated files; add new error codes or add new
1632 (or change the visibility of) public API functions. (Unix only).
1634 Running Selected Tests
1635 ----------------------
1637 You can specify a set of tests to be performed
1638 using the `make` variable `TESTS`.
1640 See the section [Running Selected Tests of
1641 test/README.md](test/README.md#running-selected-tests).
1646 Configuration Problems
1647 ----------------------
1649 ### Selecting the correct target
1651 The `./Configure` script tries hard to guess your operating system, but in some
1652 cases it does not succeed. You will see a message like the following:
1655 Operating system: x86-whatever-minix
1656 This system (minix) is not supported. See file INSTALL.md for details.
1658 Even if the automatic target selection by the `./Configure` script fails,
1659 chances are that you still might find a suitable target in the `Configurations`
1660 directory, which you can supply to the `./Configure` command,
1661 possibly after some adjustment.
1663 The `Configurations/` directory contains a lot of examples of such targets.
1664 The main configuration file is [10-main.conf], which contains all targets that
1665 are officially supported by the OpenSSL team. Other configuration files contain
1666 targets contributed by other OpenSSL users. The list of targets can be found in
1667 a Perl list `my %targets = ( ... )`.
1672 inherit_from => [ "base-target" ],
1674 cflags => add("..."),
1676 perlasm_scheme => "...",
1681 If you call `./Configure` without arguments, it will give you a list of all
1682 known targets. Using `grep`, you can lookup the target definition in the
1683 `Configurations/` directory. For example the `android-x86_64` can be found in
1684 [Configurations/15-android.conf](Configurations/15-android.conf).
1686 The directory contains two README files, which explain the general syntax and
1687 design of the configuration files.
1689 - [Configurations/README.md](Configurations/README.md)
1690 - [Configurations/README-design.md](Configurations/README-design.md)
1692 If you need further help, try to search the [openssl-users] mailing list
1693 or the [GitHub Issues] for existing solutions. If you don't find anything,
1694 you can [raise an issue] to ask a question yourself.
1696 More about our support resources can be found in the [SUPPORT] file.
1698 ### Configuration Errors
1700 If the `./Configure` or `./Configure` command fails with an error message,
1701 read the error message carefully and try to figure out whether you made
1702 a mistake (e.g., by providing a wrong option), or whether the script is
1703 working incorrectly. If you think you encountered a bug, please
1704 [raise an issue] on GitHub to file a bug report.
1706 Along with a short description of the bug, please provide the complete
1707 configure command line and the relevant output including the error message.
1709 Note: To make the output readable, please add a 'code fence' (three backquotes
1710 ` ``` ` on a separate line) before and after your output:
1713 ./Configure [your arguments...]
1722 If the build fails, look carefully at the output. Try to locate and understand
1723 the error message. It might be that the compiler is already telling you
1724 exactly what you need to do to fix your problem.
1726 There may be reasons for the failure that aren't problems in OpenSSL itself,
1727 for example if the compiler reports missing standard or third party headers.
1729 If the build succeeded previously, but fails after a source or configuration
1730 change, it might be helpful to clean the build tree before attempting another
1731 build. Use this command:
1734 $ mms clean ! (or mmk) OpenVMS
1735 $ nmake clean # Windows
1737 Assembler error messages can sometimes be sidestepped by using the `no-asm`
1738 configuration option. See also [notes](#notes-on-assembler-modules-compilation).
1740 Compiling parts of OpenSSL with gcc and others with the system compiler will
1741 result in unresolved symbols on some systems.
1743 If you are still having problems, try to search the [openssl-users] mailing
1744 list or the [GitHub Issues] for existing solutions. If you think you
1745 encountered an OpenSSL bug, please [raise an issue] to file a bug report.
1746 Please take the time to review the existing issues first; maybe the bug was
1747 already reported or has already been fixed.
1752 If some tests fail, look at the output. There may be reasons for the failure
1753 that isn't a problem in OpenSSL itself (like an OS malfunction or a Perl issue).
1755 You may want increased verbosity, that can be accomplished as described in
1756 section [Test Failures of test/README.md](test/README.md#test-failures).
1758 You may also want to selectively specify which test(s) to perform. This can be
1759 done using the `make` variable `TESTS` as described in section [Running
1760 Selected Tests of test/README.md](test/README.md#running-selected-tests).
1762 If you find a problem with OpenSSL itself, try removing any
1763 compiler optimization flags from the `CFLAGS` line in the Makefile and
1764 run `make clean; make` or corresponding.
1766 To report a bug please open an issue on GitHub, at
1767 <https://github.com/openssl/openssl/issues>.
1772 Notes on multi-threading
1773 ------------------------
1775 For some systems, the OpenSSL `Configure` script knows what compiler options
1776 are needed to generate a library that is suitable for multi-threaded
1777 applications. On these systems, support for multi-threading is enabled
1778 by default; use the `no-threads` option to disable (this should never be
1781 On other systems, to enable support for multi-threading, you will have
1782 to specify at least two options: `threads`, and a system-dependent option.
1783 (The latter is `-D_REENTRANT` on various systems.) The default in this
1784 case, obviously, is not to include support for multi-threading (but
1785 you can still use `no-threads` to suppress an annoying warning message
1786 from the `Configure` script.)
1788 OpenSSL provides built-in support for two threading models: pthreads (found on
1789 most UNIX/Linux systems), and Windows threads. No other threading models are
1790 supported. If your platform does not provide pthreads or Windows threads then
1791 you should use `Configure` with the `no-threads` option.
1793 For pthreads, all locks are non-recursive. In addition, in a debug build,
1794 the mutex attribute `PTHREAD_MUTEX_ERRORCHECK` is used. If this is not
1795 available on your platform, you might have to add
1796 `-DOPENSSL_NO_MUTEX_ERRORCHECK` to your `Configure` invocation.
1797 (On Linux `PTHREAD_MUTEX_ERRORCHECK` is an enum value, so a built-in
1798 ifdef test cannot be used.)
1800 Notes on shared libraries
1801 -------------------------
1803 For most systems the OpenSSL `Configure` script knows what is needed to
1804 build shared libraries for libcrypto and libssl. On these systems
1805 the shared libraries will be created by default. This can be suppressed and
1806 only static libraries created by using the `no-shared` option. On systems
1807 where OpenSSL does not know how to build shared libraries the `no-shared`
1808 option will be forced and only static libraries will be created.
1810 Shared libraries are named a little differently on different platforms.
1811 One way or another, they all have the major OpenSSL version number as
1812 part of the file name, i.e. for OpenSSL 1.1.x, `1.1` is somehow part of
1815 On most POSIX platforms, shared libraries are named `libcrypto.so.1.1`
1816 and `libssl.so.1.1`.
1818 on Cygwin, shared libraries are named `cygcrypto-1.1.dll` and `cygssl-1.1.dll`
1819 with import libraries `libcrypto.dll.a` and `libssl.dll.a`.
1821 On Windows build with MSVC or using MingW, shared libraries are named
1822 `libcrypto-1_1.dll` and `libssl-1_1.dll` for 32-bit Windows,
1823 `libcrypto-1_1-x64.dll` and `libssl-1_1-x64.dll` for 64-bit x86_64 Windows,
1824 and `libcrypto-1_1-ia64.dll` and `libssl-1_1-ia64.dll` for IA64 Windows.
1825 With MSVC, the import libraries are named `libcrypto.lib` and `libssl.lib`,
1826 while with MingW, they are named `libcrypto.dll.a` and `libssl.dll.a`.
1828 On VMS, shareable images (VMS speak for shared libraries) are named
1829 `ossl$libcrypto0101_shr.exe` and `ossl$libssl0101_shr.exe`. However, when
1830 OpenSSL is specifically built for 32-bit pointers, the shareable images
1831 are named `ossl$libcrypto0101_shr32.exe` and `ossl$libssl0101_shr32.exe`
1832 instead, and when built for 64-bit pointers, they are named
1833 `ossl$libcrypto0101_shr64.exe` and `ossl$libssl0101_shr64.exe`.
1835 Notes on random number generation
1836 ---------------------------------
1838 Availability of cryptographically secure random numbers is required for
1839 secret key generation. OpenSSL provides several options to seed the
1840 internal CSPRNG. If not properly seeded, the internal CSPRNG will refuse
1841 to deliver random bytes and a "PRNG not seeded error" will occur.
1843 The seeding method can be configured using the `--with-rand-seed` option,
1844 which can be used to specify a comma separated list of seed methods.
1845 However, in most cases OpenSSL will choose a suitable default method,
1846 so it is not necessary to explicitly provide this option. Note also
1847 that not all methods are available on all platforms. The FIPS provider will
1848 silently ignore seed sources that were not validated.
1850 I) On operating systems which provide a suitable randomness source (in
1851 form of a system call or system device), OpenSSL will use the optimal
1852 available method to seed the CSPRNG from the operating system's
1853 randomness sources. This corresponds to the option `--with-rand-seed=os`.
1855 II) On systems without such a suitable randomness source, automatic seeding
1856 and reseeding is disabled (`--with-rand-seed=none`) and it may be necessary
1857 to install additional support software to obtain a random seed and reseed
1858 the CSPRNG manually. Please check out the manual pages for `RAND_add()`,
1859 `RAND_bytes()`, `RAND_egd()`, and the FAQ for more information.
1861 Notes on assembler modules compilation
1862 --------------------------------------
1864 Compilation of some code paths in assembler modules might depend on whether the
1865 current assembler version supports certain ISA extensions or not. Code paths
1866 that use the AES-NI, PCLMULQDQ, SSSE3, and SHA extensions are always assembled.
1867 Apart from that, the minimum requirements for the assembler versions are shown
1870 | ISA extension | GNU as | nasm | llvm |
1871 |---------------|--------|--------|---------|
1872 | AVX | 2.19 | 2.09 | 3.0 |
1873 | AVX2 | 2.22 | 2.10 | 3.1 |
1874 | ADCX/ADOX | 2.23 | 2.10 | 3.3 |
1875 | AVX512 | 2.25 | 2.11.8 | 3.6 (*) |
1876 | AVX512IFMA | 2.26 | 2.11.8 | 6.0 (*) |
1877 | VAES | 2.30 | 2.13.3 | 6.0 (*) |
1881 (*) Even though AVX512 support was implemented in llvm 3.6, prior to version 7.0
1882 an explicit -march flag was apparently required to compile assembly modules. But
1883 then the compiler generates processor-specific code, which in turn contradicts
1884 the idea of performing dispatch at run-time, which is facilitated by the special
1885 variable `OPENSSL_ia32cap`. For versions older than 7.0, it is possible to work
1886 around the problem by forcing the build procedure to use the following script:
1889 exec clang -no-integrated-as "$@"
1891 instead of the real clang. In which case it doesn't matter what clang version
1892 is used, as it is the version of the GNU assembler that will be checked.
1899 <https://mta.openssl.org/mailman/listinfo/openssl-users>
1905 <https://github.com/openssl/openssl/issues>
1908 <https://github.com/openssl/openssl/issues/new/choose>
1911 Configurations/10-main.conf