4 This document describes installation on all supported operating
5 systems: the Unix/Linux family (including macOS), OpenVMS,
11 - [Prerequisites](#prerequisites)
12 - [Notational Conventions](#notational-conventions)
13 - [Quick Installation Guide](#quick-installation-guide)
14 - [Building OpenSSL](#building-openssl)
15 - [Installing OpenSSL](#installing-openssl)
16 - [Configuration Options](#configuration-options)
17 - [API Level](#api-level)
18 - [Cross Compile Prefix](#cross-compile-prefix)
19 - [Build Type](#build-type)
20 - [Directories](#directories)
21 - [Compiler Warnings](#compiler-warnings)
22 - [Compression Algorithm Flags](#compression-algorithm-flags)
23 - [Seeding the Random Generator](#seeding-the-random-generator)
24 - [Setting the FIPS HMAC key](#setting-the-FIPS-HMAC-key)
25 - [Enable and Disable Features](#enable-and-disable-features)
26 - [Displaying configuration data](#displaying-configuration-data)
27 - [Installation Steps in Detail](#installation-steps-in-detail)
28 - [Configure](#configure-openssl)
29 - [Build](#build-openssl)
30 - [Test](#test-openssl)
31 - [Install](#install-openssl)
32 - [Advanced Build Options](#advanced-build-options)
33 - [Environment Variables](#environment-variables)
34 - [Makefile Targets](#makefile-targets)
35 - [Running Selected Tests](#running-selected-tests)
36 - [Troubleshooting](#troubleshooting)
37 - [Configuration Problems](#configuration-problems)
38 - [Build Failures](#build-failures)
39 - [Test Failures](#test-failures)
41 - [Notes on multi-threading](#notes-on-multi-threading)
42 - [Notes on shared libraries](#notes-on-shared-libraries)
43 - [Notes on random number generation](#notes-on-random-number-generation)
44 - [Notes on assembler modules compilation](#notes-on-assembler-modules-compilation)
49 To install OpenSSL, you will need:
51 * A "make" implementation
52 * Perl 5 with core modules (please read [NOTES-PERL.md](NOTES-PERL.md))
53 * The Perl module `Text::Template` (please read [NOTES-PERL.md](NOTES-PERL.md))
55 * a development environment in the form of development libraries and C
57 * a supported operating system
59 For additional platform specific requirements, solutions to specific
60 issues and other details, please read one of these:
62 * [Notes for UNIX-like platforms](NOTES-UNIX.md)
63 * [Notes for Android platforms](NOTES-ANDROID.md)
64 * [Notes for Windows platforms](NOTES-WINDOWS.md)
65 * [Notes for the DOS platform with DJGPP](NOTES-DJGPP.md)
66 * [Notes for the OpenVMS platform](NOTES-VMS.md)
67 * [Notes for the HPE NonStop platform](NOTES-NONSTOP.md)
68 * [Notes on Perl](NOTES-PERL.md)
69 * [Notes on Valgrind](NOTES-VALGRIND.md)
71 Notational conventions
72 ======================
74 Throughout this document, we use the following conventions.
79 Any line starting with a dollar sign is a command line.
83 The dollar sign indicates the shell prompt and is not to be entered as
89 Several words in curly braces separated by pipe characters indicate a
90 **mandatory choice**, to be replaced with one of the given words.
93 $ echo { WORD1 | WORD2 | WORD3 }
95 represents one of the following three commands
103 One or several words in square brackets separated by pipe characters
104 denote an **optional choice**. It is similar to the mandatory choice,
105 but it can also be omitted entirely.
109 $ echo [ WORD1 | WORD2 | WORD3 ]
111 represents one of the four commands
124 **Optional Arguments** are enclosed in square brackets.
128 A trailing ellipsis means that more than one could be specified.
130 Quick Installation Guide
131 ========================
133 If you just want to get OpenSSL installed without bothering too much
134 about the details, here is the short version of how to build and install
135 OpenSSL. If any of the following steps fails, please consult the
136 [Installation in Detail](#installation-steps-in-detail) section below.
141 Use the following commands to configure, build and test OpenSSL.
142 The testing is optional, but recommended if you intend to install
143 OpenSSL for production use.
145 ### Unix / Linux / macOS / NonStop
153 Use the following commands to build OpenSSL:
161 If you are using Visual Studio, open a Developer Command Prompt and
162 issue the following commands to build OpenSSL.
168 As mentioned in the [Choices](#choices) section, you need to pick one
169 of the four Configure targets in the first command.
171 Most likely you will be using the `VC-WIN64A`/`VC-WIN64A-HYBRIDCRT` target for
172 64bit Windows binaries (AMD64) or `VC-WIN32`/`VC-WIN32-HYBRIDCRT` for 32bit
173 Windows binaries (X86).
174 The other two options are `VC-WIN64I` (Intel IA64, Itanium) and
175 `VC-CE` (Windows CE) are rather uncommon nowadays.
180 The following commands will install OpenSSL to a default system location.
182 **Danger Zone:** even if you are impatient, please read the following two
183 paragraphs carefully before you install OpenSSL.
185 For security reasons the default system location is by default not writable
186 for unprivileged users. So for the final installation step administrative
187 privileges are required. The default system location and the procedure to
188 obtain administrative privileges depends on the operating system.
189 It is recommended to compile and test OpenSSL with normal user privileges
190 and use administrative privileges only for the final installation step.
192 On some platforms OpenSSL is preinstalled as part of the Operating System.
193 In this case it is highly recommended not to overwrite the system versions,
194 because other applications or libraries might depend on it.
195 To avoid breaking other applications, install your copy of OpenSSL to a
196 [different location](#installing-to-a-different-location) which is not in
197 the global search path for system libraries.
199 Finally, if you plan on using the FIPS module, you need to read the
200 [Post-installation Notes](#post-installation-notes) further down.
202 ### Unix / Linux / macOS / NonStop
204 Depending on your distribution, you need to run the following command as
205 root user or prepend `sudo` to the command:
209 By default, OpenSSL will be installed to
213 More precisely, the files will be installed into the subdirectories
220 depending on the file type, as it is custom on Unix-like operating systems.
224 Use the following command to install OpenSSL.
228 By default, OpenSSL will be installed to
234 If you are using Visual Studio, open the Developer Command Prompt _elevated_
235 and issue the following command.
239 The easiest way to elevate the Command Prompt is to press and hold down both
240 the `<CTRL>` and `<SHIFT>` keys while clicking the menu item in the task menu.
242 The default installation location is
244 C:\Program Files\OpenSSL
246 for native binaries, or
248 C:\Program Files (x86)\OpenSSL
250 for 32bit binaries on 64bit Windows (WOW64).
252 #### Installing to a different location
254 To install OpenSSL to a different location (for example into your home
255 directory for testing purposes) run `Configure` as shown in the following
258 The options `--prefix` and `--openssldir` are explained in further detail in
259 [Directories](#directories) below, and the values used here are mere examples.
263 $ ./Configure --prefix=/opt/openssl --openssldir=/usr/local/ssl
267 $ perl Configure --prefix=PROGRAM:[INSTALLS] --openssldir=SYS$MANAGER:[OPENSSL]
269 Note: if you do add options to the configuration command, please make sure
270 you've read more than just this Quick Start, such as relevant `NOTES-*` files,
271 the options outline below, as configuration options may change the outcome
272 in otherwise unexpected ways.
274 Configuration Options
275 =====================
277 There are several options to `./Configure` to customize the build (note that
278 for Windows, the defaults for `--prefix` and `--openssldir` depend on what
279 configuration is used and what Windows implementation OpenSSL is built on.
280 For more information, see the [Notes for Windows platforms](NOTES-WINDOWS.md).
287 Build the OpenSSL libraries to support the API for the specified version.
288 If [no-deprecated](#no-deprecated) is also given, don't build with support
289 for deprecated APIs in or below the specified version number. For example,
292 --api=1.1.0 no-deprecated
294 will remove support for all APIs that were deprecated in OpenSSL version
295 1.1.0 or below. This is a rather specialized option for developers.
296 If you just intend to remove all deprecated APIs up to the current version
297 entirely, just specify [no-deprecated](#no-deprecated).
298 If `--api` isn't given, it defaults to the current (minor) OpenSSL version.
303 --cross-compile-prefix=<PREFIX>
305 The `<PREFIX>` to include in front of commands for your toolchain.
307 It is likely to have to end with dash, e.g. `a-b-c-` would invoke GNU compiler
308 as `a-b-c-gcc`, etc. Unfortunately cross-compiling is too case-specific to put
309 together one-size-fits-all instructions. You might have to pass more flags or
310 set up environment variables to actually make it work. Android and iOS cases
311 are discussed in corresponding `Configurations/15-*.conf` files. But there are
312 cases when this option alone is sufficient. For example to build the mingw64
313 target on Linux `--cross-compile-prefix=x86_64-w64-mingw32-` works. Naturally
314 provided that mingw packages are installed. Today Debian and Ubuntu users
315 have option to install a number of prepackaged cross-compilers along with
316 corresponding run-time and development packages for "alien" hardware. To give
317 another example `--cross-compile-prefix=mipsel-linux-gnu-` suffices in such
320 For cross compilation, you must [configure manually](#manual-configuration).
321 Also, note that `--openssldir` refers to target's file system, not one you are
329 Build OpenSSL with debugging symbols and zero optimization level.
333 Build OpenSSL without debugging symbols. This is the default.
342 The name of the directory under the top of the installation directory tree
343 (see the `--prefix` option) where libraries will be installed. By default
344 this is `lib`. Note that on Windows only static libraries (`*.lib`) will
345 be stored in this location. Shared libraries (`*.dll`) will always be
346 installed to the `bin` directory.
348 Some build targets have a multilib postfix set in the build configuration.
349 For these targets the default libdir is `lib<multilib-postfix>`. Please use
350 `--libdir=lib` to override the libdir if adding the postfix is undesirable.
356 Directory for OpenSSL configuration files, and also the default certificate
357 and key store. Defaults are:
360 Windows: C:\Program Files\Common Files\SSL
361 OpenVMS: SYS$COMMON:[OPENSSL-COMMON]
363 For 32bit Windows applications on Windows 64bit (WOW64), always replace
364 `C:\Program Files` by `C:\Program Files (x86)`.
370 The top of the installation directory tree. Defaults are:
373 Windows: C:\Program Files\OpenSSL
374 OpenVMS: SYS$COMMON:[OPENSSL]
381 This is a developer flag that switches on various compiler options recommended
382 for OpenSSL development. It only works when using gcc or clang as the compiler.
383 If you are developing a patch for OpenSSL then it is recommended that you use
384 this option where possible.
386 Compression Algorithm Flags
387 ---------------------------
389 ### with-brotli-include
391 --with-brotli-include=DIR
393 The directory for the location of the brotli include files (i.e. the location
394 of the **brotli** include directory). This option is only necessary if
395 [enable-brotli](#enable-brotli) is used and the include files are not already
396 on the system include path.
400 --with-brotli-lib=LIB
402 **On Unix**: this is the directory containing the brotli libraries.
403 If not provided, the system library path will be used.
405 The names of the libraries are:
407 * libbrotlicommon.a or libbrotlicommon.so
408 * libbrotlidec.a or libbrotlidec.so
409 * libbrotlienc.a or libbrotlienc.so
411 **On Windows:** this is the directory containing the brotli libraries.
412 If not provided, the system library path will be used.
414 The names of the libraries are:
420 ### with-zlib-include
422 --with-zlib-include=DIR
424 The directory for the location of the zlib include file. This option is only
425 necessary if [zlib](#zlib) is used and the include file is not
426 already on the system include path.
432 **On Unix**: this is the directory containing the zlib library.
433 If not provided the system library path will be used.
435 **On Windows:** this is the filename of the zlib library (with or
436 without a path). This flag must be provided if the
437 [zlib-dynamic](#zlib-dynamic) option is not also used. If `zlib-dynamic` is used
438 then this flag is optional and defaults to `ZLIB1` if not provided.
440 **On VMS:** this is the filename of the zlib library (with or without a path).
441 This flag is optional and if not provided then `GNV$LIBZSHR`, `GNV$LIBZSHR32`
442 or `GNV$LIBZSHR64` is used by default depending on the pointer size chosen.
444 ### with-zstd-include
446 --with-zstd-include=DIR
448 The directory for the location of the Zstd include file. This option is only
449 necessary if [enable-std](#enable-zstd) is used and the include file is not
450 already on the system include path.
452 OpenSSL requires Zstd 1.4 or greater. The Linux kernel source contains a
453 *zstd.h* file that is not compatible with the 1.4.x Zstd distribution, the
454 compilation will generate an error if the Linux *zstd.h* is included before
455 (or instead of) the Zstd distribution header.
461 **On Unix**: this is the directory containing the Zstd library.
462 If not provided the system library path will be used.
464 **On Windows:** this is the filename of the Zstd library (with or
465 without a path). This flag must be provided if the
466 [enable-zstd-dynamic](#enable-zstd-dynamic) option is not also used.
467 If `zstd-dynamic` is used then this flag is optional and defaults
468 to `LIBZSTD` if not provided.
470 Seeding the Random Generator
471 ----------------------------
473 --with-rand-seed=seed1[,seed2,...]
475 A comma separated list of seeding methods which will be tried by OpenSSL
476 in order to obtain random input (a.k.a "entropy") for seeding its
477 cryptographically secure random number generator (CSPRNG).
478 The current seeding methods are:
482 Use a trusted operating system entropy source.
483 This is the default method if such an entropy source exists.
487 Use the [getrandom(2)][man-getrandom] or equivalent system call.
489 [man-getrandom]: http://man7.org/linux/man-pages/man2/getrandom.2.html
493 Use the first device from the `DEVRANDOM` list which can be opened to read
494 random bytes. The `DEVRANDOM` preprocessor constant expands to
496 "/dev/urandom","/dev/random","/dev/srandom"
498 on most unix-ish operating systems.
502 Check for an entropy generating daemon.
503 This source is ignored by the FIPS provider.
507 Use the `RDSEED` or `RDRAND` command on x86 or `RNDRRS` command on aarch64
508 if provided by the CPU.
512 Use librandom (not implemented yet).
513 This source is ignored by the FIPS provider.
517 Disable automatic seeding. This is the default on some operating systems where
518 no suitable entropy source exists, or no support for it is implemented yet.
519 This option is ignored by the FIPS provider.
521 For more information, see the section [Notes on random number generation][rng]
522 at the end of this document.
524 [rng]: #notes-on-random-number-generation
526 Setting the FIPS HMAC key
527 -------------------------
531 As part of its self-test validation, the FIPS module must verify itself
532 by performing a SHA-256 HMAC computation on itself. The default key is
533 the SHA256 value of "holy hand grenade of antioch" and is sufficient
534 for meeting the FIPS requirements.
536 To change the key to a different value, use this flag. The value should
537 be a hex string no more than 64 characters.
539 Enable and Disable Features
540 ---------------------------
542 Feature options always come in pairs, an option to enable feature
543 `xxxx`, and an option to disable it:
545 [ enable-xxxx | no-xxxx ]
547 Whether a feature is enabled or disabled by default, depends on the feature.
548 In the following list, always the non-default variant is documented: if
549 feature `xxxx` is disabled by default then `enable-xxxx` is documented and
550 if feature `xxxx` is enabled by default then `no-xxxx` is documented.
554 Don't build the AFALG engine.
556 This option will be forced on a platform that does not support AFALG.
560 Build with Kernel TLS support.
562 This option will enable the use of the Kernel TLS data-path, which can improve
563 performance and allow for the use of sendfile and splice system calls on
564 TLS sockets. The Kernel may use TLS accelerators if any are available on the
565 system. This option will be forced off on systems that do not support the
566 Kernel TLS data-path.
570 Build with the Address sanitiser.
572 This is a developer option only. It may not work on all platforms and should
573 never be used in production environments. It will only work when used with
574 gcc or clang and should be used in conjunction with the [no-shared](#no-shared)
577 ### enable-acvp-tests
579 Build support for Automated Cryptographic Validation Protocol (ACVP)
582 This is required for FIPS validation purposes. Certain ACVP tests require
583 access to algorithm internals that are not normally accessible.
584 Additional information related to ACVP can be found at
585 <https://github.com/usnistgov/ACVP>.
589 Do not build apps, e.g. the openssl program. This is handy for minimization.
590 This option also disables tests.
594 Do not use assembler code.
596 This should be viewed as debugging/troubleshooting option rather than for
597 production use. On some platforms a small amount of assembler code may still
598 be used even with this option.
602 Do not build support for async operations.
606 Do not use `atexit()` in libcrypto builds.
608 `atexit()` has varied semantics between platforms and can cause SIGSEGV in some
609 circumstances. This option disables the atexit registration of OPENSSL_cleanup.
610 By default, NonStop configurations use `no-atexit`.
614 Don't automatically load all supported ciphers and digests.
616 Typically OpenSSL will make available all of its supported ciphers and digests.
617 For a statically linked application this may be undesirable if small executable
618 size is an objective. This only affects libcrypto. Ciphers and digests will
619 have to be loaded manually using `EVP_add_cipher()` and `EVP_add_digest()`
620 if this option is used. This option will force a non-shared build.
624 Don't automatically load all libcrypto/libssl error strings.
626 Typically OpenSSL will automatically load human readable error strings. For a
627 statically linked application this may be undesirable if small executable size
632 Build with support for brotli compression/decompression.
634 ### enable-brotli-dynamic
636 Like the enable-brotli option, but has OpenSSL load the brotli library dynamically
639 This is only supported on systems where loading of shared libraries is supported.
641 ### no-autoload-config
643 Don't automatically load the default `openssl.cnf` file.
645 Typically OpenSSL will automatically load a system config file which configures
648 ### enable-buildtest-c++
650 While testing, generate C++ buildtest files that simply check that the public
651 OpenSSL header files are usable standalone with C++.
653 Enabling this option demands extra care. For any compiler flag given directly
654 as configuration option, you must ensure that it's valid for both the C and
655 the C++ compiler. If not, the C++ build test will most likely break. As an
656 alternative, you can use the language specific variables, `CFLAGS` and `CXXFLAGS`.
660 Use the specified text instead of the default banner at the end of
665 On platforms where the choice of 32-bit or 64-bit architecture
666 is not explicitly specified, `Configure` will print a warning
667 message and wait for a few seconds to let you interrupt the
668 configuration. Using this flag skips the wait.
672 Build only some minimal set of features.
673 This is a developer option used internally for CI build tests of the project.
677 Never cache algorithms when they are fetched from a provider. Normally, a
678 provider indicates if the algorithms it supplies can be cached or not. Using
679 this option will reduce run-time memory usage but it also introduces a
680 significant performance penalty. This option is primarily designed to help
681 with detecting incorrect reference counting.
685 Don't build the CAPI engine.
687 This option will be forced if on a platform that does not support CAPI.
691 Don't build support for Certificate Management Protocol (CMP)
692 and Certificate Request Message Format (CRMF).
696 Don't build support for Cryptographic Message Syntax (CMS).
700 Don't build support for SSL/TLS compression.
702 If this option is enabled (the default), then compression will only work if
703 the zlib or `zlib-dynamic` options are also chosen.
705 ### enable-crypto-mdebug
707 This now only enables the `failed-malloc` feature.
709 ### enable-crypto-mdebug-backtrace
711 This is a no-op; the project uses the compiler's address/leak sanitizer instead.
715 Don't build support for Certificate Transparency (CT).
719 Don't build with support for deprecated APIs up until and including the version
720 given with `--api` (or the current version, if `--api` wasn't specified).
724 Don't build support for datagram based BIOs.
726 Selecting this option will also force the disabling of DTLS.
730 Don't build and install documentation, i.e. manual pages in various forms.
734 Don't build support for loading Dynamic Shared Objects (DSO)
736 ### enable-devcryptoeng
738 Build the `/dev/crypto` engine.
740 This option is automatically selected on the BSD platform, in which case it can
741 be disabled with `no-devcryptoeng`.
743 ### no-dynamic-engine
745 Don't build the dynamically loaded engines.
747 This only has an effect in a shared build.
751 Don't build support for Elliptic Curves.
755 Don't build support for binary Elliptic Curves
757 ### enable-ec_nistp_64_gcc_128
759 Enable support for optimised implementations of some commonly used NIST
762 This option is only supported on platforms:
764 - with little-endian storage of non-byte types
765 - that tolerate misaligned memory references
766 - where the compiler:
767 - supports the non-standard type `__uint128_t`
768 - defines the built-in macro `__SIZEOF_INT128__`
772 Build support for gathering entropy from the Entropy Gathering Daemon (EGD).
776 Don't build support for loading engines.
780 Don't compile in any error strings.
782 ### enable-external-tests
784 Enable building of integration with external test suites.
786 This is a developer option and may not work on all platforms. The following
787 external test suites are currently supported:
789 - GOST engine test suite
790 - Python PYCA/Cryptography test suite
793 See the file [test/README-external.md](test/README-external.md)
798 Don't compile in filename and line number information (e.g. for errors and
803 Build (and install) the FIPS provider
805 ### no-fips-securitychecks
807 Don't perform FIPS module run-time checks related to enforcement of security
808 parameters such as minimum security strength of keys.
810 ### enable-fuzz-libfuzzer, enable-fuzz-afl
812 Build with support for fuzzing using either libfuzzer or AFL.
814 These are developer options only. They may not work on all platforms and
815 should never be used in production environments.
817 See the file [fuzz/README.md](fuzz/README.md) for further details.
821 Don't build support for GOST based ciphersuites.
823 Note that if this feature is enabled then GOST ciphersuites are only available
824 if the GOST algorithms are also available through loading an externally supplied
829 Disable HTTP support.
833 Don't build the legacy provider.
835 Disabling this also disables the legacy algorithms: MD2 (already disabled by default).
839 Don't generate dependencies.
843 Don't build any dynamically loadable engines.
845 This also implies `no-dynamic-engine`.
849 Don't build support for writing multiple records in one go in libssl
851 Note: this is a different capability to the pipelining functionality.
855 Don't build support for the Next Protocol Negotiation (NPN) TLS extension.
859 Don't build support for Online Certificate Status Protocol (OCSP).
863 Don't build the padlock engine.
867 As synonym for `no-padlockeng`. Deprecated and should not be used.
871 Don't build with support for Position Independent Code.
875 Build with support for Position Independent Execution.
879 Don't pin the shared libraries.
881 By default OpenSSL will attempt to stay in memory until the process exits.
882 This is so that libcrypto and libssl can be properly cleaned up automatically
883 via an `atexit()` handler. The handler is registered by libcrypto and cleans
884 up both libraries. On some platforms the `atexit()` handler will run on unload of
885 libcrypto (if it has been dynamically loaded) rather than at process exit.
887 This option can be used to stop OpenSSL from attempting to stay in memory until the
888 process exits. This could lead to crashes if either libcrypto or libssl have
889 already been unloaded at the point that the atexit handler is invoked, e.g. on a
890 platform which calls `atexit()` on unload of the library, and libssl is unloaded
891 before libcrypto then a crash is likely to happen.
893 Note that shared library pinning is not automatically disabled for static builds,
894 i.e., `no-shared` does not imply `no-pinshared`. This may come as a surprise when
895 linking libcrypto statically into a shared third-party library, because in this
896 case the shared library will be pinned. To prevent this behaviour, you need to
897 configure the static build using `no-shared` and `no-pinshared` together.
899 Applications can suppress running of the `atexit()` handler at run time by
900 using the `OPENSSL_INIT_NO_ATEXIT` option to `OPENSSL_init_crypto()`.
901 See the man page for it for further details.
905 Don't use POSIX IO capabilities.
909 Don't build support for Pre-Shared Key based ciphersuites.
913 Don't use hardware RDRAND capabilities.
917 Don't build support for RFC3779, "X.509 Extensions for IP Addresses and
922 Build support for Stream Control Transmission Protocol (SCTP).
926 Do not create shared libraries, only static ones.
928 See [Notes on shared libraries](#notes-on-shared-libraries) below.
932 Disable using the SM2 precomputed table on aarch64 to make the library smaller.
936 Don't build support for socket BIOs.
940 Don't build support for Secure Remote Password (SRP) protocol or
941 SRP based ciphersuites.
945 Don't build Secure Real-Time Transport Protocol (SRTP) support.
949 Exclude SSE2 code paths from 32-bit x86 assembly modules.
951 Normally SSE2 extension is detected at run-time, but the decision whether or not
952 the machine code will be executed is taken solely on CPU capability vector. This
953 means that if you happen to run OS kernel which does not support SSE2 extension
954 on Intel P4 processor, then your application might be exposed to "illegal
955 instruction" exception. There might be a way to enable support in kernel, e.g.
956 FreeBSD kernel can be compiled with `CPU_ENABLE_SSE`, and there is a way to
957 disengage SSE2 code paths upon application start-up, but if you aim for wider
958 "audience" running such kernel, consider `no-sse2`. Both the `386` and `no-asm`
959 options imply `no-sse2`.
963 Don't build with SSL Trace capabilities.
965 This removes the `-trace` option from `s_client` and `s_server`, and omits the
966 `SSL_trace()` function from libssl.
968 Disabling `ssl-trace` may provide a small reduction in libssl binary size.
972 Don't build the statically linked engines.
974 This only has an impact when not built "shared".
978 Don't use anything from the C header file `stdio.h` that makes use of the `FILE`
979 type. Only libcrypto and libssl can be built in this way. Using this option will
980 suppress building the command line applications. Additionally, since the OpenSSL
981 tests also use the command line applications, the tests will also be skipped.
985 Don't build test programs or run any tests.
989 Build with support for TCP Fast Open (RFC7413). Supported on Linux, macOS and FreeBSD.
993 Don't build with QUIC support.
997 Don't build with support for multi-threaded applications.
1001 Build with support for multi-threaded applications. Most platforms will enable
1002 this by default. However, if on a platform where this is not the case then this
1003 will usually require additional system-dependent options!
1005 See [Notes on multi-threading](#notes-on-multi-threading) below.
1009 Don't build with support for thread pool functionality.
1013 Build with thread pool functionality. If enabled, OpenSSL algorithms may
1014 use the thread pool to perform parallel computation. This option in itself
1015 does not enable OpenSSL to spawn new threads. Currently the only supported
1016 thread pool mechanism is the default thread pool.
1018 ### no-default-thread-pool
1020 Don't build with support for default thread pool functionality.
1022 ### default-thread-pool
1024 Build with default thread pool functionality. If enabled, OpenSSL may create
1025 and manage threads up to a maximum number of threads authorized by the
1026 application. Supported on POSIX compliant platforms and Windows.
1030 Build with support for the integrated tracing api.
1032 See manual pages OSSL_trace_set_channel(3) and OSSL_trace_enabled(3) for details.
1036 Don't build Time Stamping (TS) Authority support.
1040 Build with the Undefined Behaviour sanitiser (UBSAN).
1042 This is a developer option only. It may not work on all platforms and should
1043 never be used in production environments. It will only work when used with
1044 gcc or clang and should be used in conjunction with the `-DPEDANTIC` option
1045 (or the `--strict-warnings` option).
1049 Don't build with the User Interface (UI) console method
1051 The User Interface console method enables text based console prompts.
1053 ### enable-unit-test
1055 Enable additional unit test APIs.
1057 This should not typically be used in production deployments.
1061 Don't build support for UPLINK interface.
1063 ### enable-weak-ssl-ciphers
1065 Build support for SSL/TLS ciphers that are considered "weak"
1067 Enabling this includes for example the RC4 based ciphersuites.
1071 Build with support for zlib compression/decompression.
1075 Like the zlib option, but has OpenSSL load the zlib library dynamically
1078 This is only supported on systems where loading of shared libraries is supported.
1082 Build with support for Zstd compression/decompression.
1084 ### enable-zstd-dynamic
1086 Like the enable-zstd option, but has OpenSSL load the Zstd library dynamically
1089 This is only supported on systems where loading of shared libraries is supported.
1091 ### enable-unstable-qlog
1093 Enables qlog output support for the QUIC protocol. This functionality is
1094 unstable and implements a draft version of the qlog specification. The qlog
1095 output from OpenSSL will change in incompatible ways in future, and is not
1096 subject to any format stability or compatibility guarantees at this time. See
1097 the manpage openssl-qlog(7) for details.
1101 In 32-bit x86 builds, use the 80386 instruction set only in assembly modules
1103 The default x86 code is more efficient, but requires at least an 486 processor.
1104 Note: This doesn't affect compiler generated code, so this option needs to be
1105 accompanied by a corresponding compiler-specific option.
1109 no-{ssl|ssl3|tls|tls1|tls1_1|tls1_2|tls1_3|dtls|dtls1|dtls1_2}
1111 Don't build support for negotiating the specified SSL/TLS protocol.
1113 If `no-tls` is selected then all of `tls1`, `tls1_1`, `tls1_2` and `tls1_3`
1115 Similarly `no-dtls` will disable `dtls1` and `dtls1_2`. The `no-ssl` option is
1116 synonymous with `no-ssl3`. Note this only affects version negotiation.
1117 OpenSSL will still provide the methods for applications to explicitly select
1118 the individual protocol versions.
1120 ### no-{protocol}-method
1122 no-{ssl3|tls1|tls1_1|tls1_2|dtls1|dtls1_2}-method
1124 Analogous to `no-{protocol}` but in addition do not build the methods for
1125 applications to explicitly select individual protocol versions. Note that there
1126 is no `no-tls1_3-method` option because there is no application method for
1129 Using individual protocol methods directly is deprecated. Applications should
1130 use `TLS_method()` instead.
1132 ### enable-{algorithm}
1136 Build with support for the specified algorithm.
1140 no-{aria|bf|blake2|camellia|cast|chacha|cmac|
1141 des|dh|dsa|ecdh|ecdsa|idea|md4|mdc2|ocb|
1142 poly1305|rc2|rc4|rmd160|scrypt|seed|
1143 siphash|siv|sm2|sm3|sm4|whirlpool}
1145 Build without support for the specified algorithm.
1147 The `ripemd` algorithm is deprecated and if used is synonymous with `rmd160`.
1149 ### Compiler-specific options
1151 -Dxxx, -Ixxx, -Wp, -lxxx, -Lxxx, -Wl, -rpath, -R, -framework, -static
1153 These system specific options will be recognised and passed through to the
1154 compiler to allow you to define preprocessor symbols, specify additional
1155 libraries, library directories or other compiler options. It might be worth
1156 noting that some compilers generate code specifically for processor the
1157 compiler currently executes on. This is not necessarily what you might have
1158 in mind, since it might be unsuitable for execution on other, typically older,
1159 processor. Consult your compiler documentation.
1161 Take note of the [Environment Variables](#environment-variables) documentation
1162 below and how these flags interact with those variables.
1166 Additional options that are not otherwise recognised are passed through as
1167 they are to the compiler as well. Unix-style options beginning with a
1168 `-` or `+` and Windows-style options beginning with a `/` are recognised.
1169 Again, consult your compiler documentation.
1171 If the option contains arguments separated by spaces, then the URL-style
1172 notation `%20` can be used for the space character in order to avoid having
1173 to quote the option. For example, `-opt%20arg` gets expanded to `-opt arg`.
1174 In fact, any ASCII character can be encoded as %xx using its hexadecimal
1177 Take note of the [Environment Variables](#environment-variables) documentation
1178 below and how these flags interact with those variables.
1180 ### Environment Variables
1184 Assign the given value to the environment variable `VAR` for `Configure`.
1186 These work just like normal environment variable assignments, but are supported
1187 on all platforms and are confined to the configuration scripts only.
1188 These assignments override the corresponding value in the inherited environment,
1191 The following variables are used as "`make` variables" and can be used as an
1192 alternative to giving preprocessor, compiler and linker options directly as
1193 configuration. The following variables are supported:
1195 AR The static library archiver.
1196 ARFLAGS Flags for the static library archiver.
1197 AS The assembler compiler.
1198 ASFLAGS Flags for the assembler compiler.
1200 CFLAGS Flags for the C compiler.
1201 CXX The C++ compiler.
1202 CXXFLAGS Flags for the C++ compiler.
1203 CPP The C/C++ preprocessor.
1204 CPPFLAGS Flags for the C/C++ preprocessor.
1205 CPPDEFINES List of CPP macro definitions, separated
1206 by a platform specific character (':' or
1207 space for Unix, ';' for Windows, ',' for
1208 VMS). This can be used instead of using
1209 -D (or what corresponds to that on your
1210 compiler) in CPPFLAGS.
1211 CPPINCLUDES List of CPP inclusion directories, separated
1212 the same way as for CPPDEFINES. This can
1213 be used instead of -I (or what corresponds
1214 to that on your compiler) in CPPFLAGS.
1215 HASHBANGPERL Perl invocation to be inserted after '#!'
1216 in public perl scripts (only relevant on
1218 LD The program linker (not used on Unix, $(CC)
1220 LDFLAGS Flags for the shared library, DSO and
1222 LDLIBS Extra libraries to use when linking.
1223 Takes the form of a space separated list
1224 of library specifications on Unix and
1225 Windows, and as a comma separated list of
1227 RANLIB The library archive indexer.
1228 RC The Windows resource compiler.
1229 RCFLAGS Flags for the Windows resource compiler.
1230 RM The command to remove files and directories.
1232 These cannot be mixed with compiling/linking flags given on the command line.
1233 In other words, something like this isn't permitted.
1235 $ ./Configure -DFOO CPPFLAGS=-DBAR -DCOOKIE
1237 Backward compatibility note:
1239 To be compatible with older configuration scripts, the environment variables
1240 are ignored if compiling/linking flags are given on the command line, except
1243 AR, CC, CXX, CROSS_COMPILE, HASHBANGPERL, PERL, RANLIB, RC, and WINDRES
1245 For example, the following command will not see `-DBAR`:
1247 $ CPPFLAGS=-DBAR ./Configure -DCOOKIE
1249 However, the following will see both set variables:
1251 $ CC=gcc CROSS_COMPILE=x86_64-w64-mingw32- ./Configure -DCOOKIE
1253 If `CC` is set, it is advisable to also set `CXX` to ensure both the C and C++
1254 compiler are in the same "family". This becomes relevant with
1255 `enable-external-tests` and `enable-buildtest-c++`.
1262 Reconfigure from earlier data.
1264 This fetches the previous command line options and environment from data
1265 saved in `configdata.pm` and runs the configuration process again, using
1266 these options and environment. Note: NO other option is permitted together
1267 with `reconf`. Note: The original configuration saves away values for ALL
1268 environment variables that were used, and if they weren't defined, they are
1269 still saved away with information that they weren't originally defined.
1270 This information takes precedence over environment variables that are
1271 defined when reconfiguring.
1273 Displaying configuration data
1274 -----------------------------
1276 The configuration script itself will say very little, and finishes by
1277 creating `configdata.pm`. This perl module can be loaded by other scripts
1278 to find all the configuration data, and it can also be used as a script to
1279 display all sorts of configuration data in a human readable form.
1281 For more information, please do:
1283 $ ./configdata.pm --help # Unix
1287 $ perl configdata.pm --help # Windows and VMS
1289 Installation Steps in Detail
1290 ============================
1295 ### Automatic Configuration
1297 In previous version, the `config` script determined the platform type and
1298 compiler and then called `Configure`. Starting with this release, they are
1301 #### Unix / Linux / macOS
1303 $ ./Configure [options...]
1307 $ perl Configure [options...]
1311 $ perl Configure [options...]
1313 ### Manual Configuration
1315 OpenSSL knows about a range of different operating system, hardware and
1316 compiler combinations. To see the ones it knows about, run
1318 $ ./Configure LIST # Unix
1322 $ perl Configure LIST # All other platforms
1324 For the remainder of this text, the Unix form will be used in all examples.
1325 Please use the appropriate form for your platform.
1327 Pick a suitable name from the list that matches your system. For most
1328 operating systems there is a choice between using cc or gcc.
1329 When you have identified your system (and if necessary compiler) use this
1330 name as the argument to `Configure`. For example, a `linux-elf` user would
1333 $ ./Configure linux-elf [options...]
1335 ### Creating your own Configuration
1337 If your system isn't listed, you will have to create a configuration
1338 file named `Configurations/YOURFILENAME.conf` (replace `YOURFILENAME`
1339 with a filename of your choosing) and add the correct
1340 configuration for your system. See the available configs as examples
1341 and read [Configurations/README.md](Configurations/README.md) and
1342 [Configurations/README-design.md](Configurations/README-design.md)
1343 for more information.
1345 The generic configurations `cc` or `gcc` should usually work on 32 bit
1348 `Configure` creates a build file (`Makefile` on Unix, `makefile` on Windows
1349 and `descrip.mms` on OpenVMS) from a suitable template in `Configurations/`,
1350 and defines various macros in `include/openssl/configuration.h` (generated
1351 from `include/openssl/configuration.h.in`.
1353 If none of the generated build files suit your purpose, it's possible to
1354 write your own build file template and give its name through the environment
1355 variable `BUILDFILE`. For example, Ninja build files could be supported by
1356 writing `Configurations/build.ninja.tmpl` and then configure with `BUILDFILE`
1357 set like this (Unix syntax shown, you'll have to adapt for other platforms):
1359 $ BUILDFILE=build.ninja perl Configure [options...]
1361 ### Out of Tree Builds
1363 OpenSSL can be configured to build in a build directory separate from the
1364 source code directory. It's done by placing yourself in some other
1365 directory and invoking the configuration commands from there.
1369 $ mkdir /var/tmp/openssl-build
1370 $ cd /var/tmp/openssl-build
1371 $ /PATH/TO/OPENSSL/SOURCE/Configure [options...]
1373 #### OpenVMS example
1375 $ set default sys$login:
1376 $ create/dir [.tmp.openssl-build]
1377 $ set default [.tmp.openssl-build]
1378 $ perl D:[PATH.TO.OPENSSL.SOURCE]Configure [options...]
1380 #### Windows example
1383 $ mkdir \temp-openssl
1385 $ perl d:\PATH\TO\OPENSSL\SOURCE\Configure [options...]
1387 Paths can be relative just as well as absolute. `Configure` will do its best
1388 to translate them to relative paths whenever possible.
1393 Build OpenSSL by running:
1396 $ mms ! (or mmk) OpenVMS
1399 This will build the OpenSSL libraries (`libcrypto.a` and `libssl.a` on
1400 Unix, corresponding on other platforms) and the OpenSSL binary
1401 (`openssl`). The libraries will be built in the top-level directory,
1402 and the binary will be in the `apps/` subdirectory.
1404 If the build fails, take a look at the [Build Failures](#build-failures)
1405 subsection of the [Troubleshooting](#troubleshooting) section.
1410 After a successful build, and before installing, the libraries should
1414 $ mms test ! OpenVMS
1415 $ nmake test # Windows
1417 **Warning:** you MUST run the tests from an unprivileged account (or disable
1418 your privileges temporarily if your platform allows it).
1420 See [test/README.md](test/README.md) for further details how run tests.
1422 See [test/README-dev.md](test/README-dev.md) for guidelines on adding tests.
1427 If everything tests ok, install OpenSSL with
1429 $ make install # Unix
1430 $ mms install ! OpenVMS
1431 $ nmake install # Windows
1433 Note that in order to perform the install step above you need to have
1434 appropriate permissions to write to the installation directory.
1436 The above commands will install all the software components in this
1437 directory tree under `<PREFIX>` (the directory given with `--prefix` or
1440 ### Unix / Linux / macOS
1442 bin/ Contains the openssl binary and a few other
1445 Contains the header files needed if you want
1446 to build your own programs that use libcrypto
1448 lib Contains the OpenSSL library files.
1449 lib/engines Contains the OpenSSL dynamically loadable engines.
1451 share/man/man1 Contains the OpenSSL command line man-pages.
1452 share/man/man3 Contains the OpenSSL library calls man-pages.
1453 share/man/man5 Contains the OpenSSL configuration format man-pages.
1454 share/man/man7 Contains the OpenSSL other misc man-pages.
1456 share/doc/openssl/html/man1
1457 share/doc/openssl/html/man3
1458 share/doc/openssl/html/man5
1459 share/doc/openssl/html/man7
1460 Contains the HTML rendition of the man-pages.
1464 'arch' is replaced with the architecture name, `ALPHA` or `IA64`,
1465 'sover' is replaced with the shared library version (`0101` for 1.1), and
1466 'pz' is replaced with the pointer size OpenSSL was built with:
1468 [.EXE.'arch'] Contains the openssl binary.
1469 [.EXE] Contains a few utility scripts.
1471 Contains the header files needed if you want
1472 to build your own programs that use libcrypto
1474 [.LIB.'arch'] Contains the OpenSSL library files.
1475 [.ENGINES'sover''pz'.'arch']
1476 Contains the OpenSSL dynamically loadable engines.
1477 [.SYS$STARTUP] Contains startup, login and shutdown scripts.
1478 These define appropriate logical names and
1480 [.SYSTEST] Contains the installation verification procedure.
1481 [.HTML] Contains the HTML rendition of the manual pages.
1483 ### Additional Directories
1485 Additionally, install will add the following directories under
1486 OPENSSLDIR (the directory given with `--openssldir` or its default)
1487 for you convenience:
1489 certs Initially empty, this is the default location
1490 for certificate files.
1491 private Initially empty, this is the default location
1492 for private key files.
1493 misc Various scripts.
1495 The installation directory should be appropriately protected to ensure
1496 unprivileged users cannot make changes to OpenSSL binaries or files, or
1497 install engines. If you already have a pre-installed version of OpenSSL as
1498 part of your Operating System it is recommended that you do not overwrite
1499 the system version and instead install to somewhere else.
1501 Package builders who want to configure the library for standard locations,
1502 but have the package installed somewhere else so that it can easily be
1505 $ make DESTDIR=/tmp/package-root install # Unix
1506 $ mms/macro="DESTDIR=TMP:[PACKAGE-ROOT]" install ! OpenVMS
1508 The specified destination directory will be prepended to all installation
1511 Compatibility issues with previous OpenSSL versions
1512 ---------------------------------------------------
1514 ### COMPILING existing applications
1516 Starting with version 1.1.0, OpenSSL hides a number of structures that were
1517 previously open. This includes all internal libssl structures and a number
1518 of EVP types. Accessor functions have been added to allow controlled access
1519 to the structures' data.
1521 This means that some software needs to be rewritten to adapt to the new ways
1522 of doing things. This often amounts to allocating an instance of a structure
1523 explicitly where you could previously allocate them on the stack as automatic
1524 variables, and using the provided accessor functions where you would previously
1525 access a structure's field directly.
1527 Some APIs have changed as well. However, older APIs have been preserved when
1530 Post-installation Notes
1531 -----------------------
1533 With the default OpenSSL installation comes a FIPS provider module, which
1534 needs some post-installation attention, without which it will not be usable.
1535 This involves using the following command:
1537 $ openssl fipsinstall
1539 See the openssl-fipsinstall(1) manual for details and examples.
1541 Advanced Build Options
1542 ======================
1544 Environment Variables
1545 ---------------------
1547 A number of environment variables can be used to provide additional control
1548 over the build process. Typically these should be defined prior to running
1549 `Configure`. Not all environment variables are relevant to all platforms.
1552 The name of the ar executable to use.
1555 Use a different build file name than the platform default
1556 ("Makefile" on Unix-like platforms, "makefile" on native Windows,
1557 "descrip.mms" on OpenVMS). This requires that there is a
1558 corresponding build file template.
1559 See [Configurations/README.md](Configurations/README.md)
1560 for further information.
1563 The compiler to use. Configure will attempt to pick a default
1564 compiler for your platform but this choice can be overridden
1565 using this variable. Set it to the compiler executable you wish
1566 to use, e.g. gcc or clang.
1569 This environment variable has the same meaning as for the
1570 "--cross-compile-prefix" Configure flag described above. If both
1571 are set then the Configure flag takes precedence.
1574 The command string for the Perl executable to insert in the
1575 #! line of perl scripts that will be publicly installed.
1576 Default: /usr/bin/env perl
1577 Note: the value of this variable is added to the same scripts
1578 on all platforms, but it's only relevant on Unix-like platforms.
1581 This can be the value `32` or `64` to specify the architecture
1582 when it is not "obvious" to the configuration. It should generally
1583 not be necessary to specify this environment variable.
1586 The name of the nm executable to use.
1588 OPENSSL_LOCAL_CONFIG_DIR
1589 OpenSSL comes with a database of information about how it
1590 should be built on different platforms as well as build file
1591 templates for those platforms. The database is comprised of
1592 ".conf" files in the Configurations directory. The build
1593 file templates reside there as well as ".tmpl" files. See the
1594 file [Configurations/README.md](Configurations/README.md)
1595 for further information about the format of ".conf" files
1596 as well as information on the ".tmpl" files.
1597 In addition to the standard ".conf" and ".tmpl" files, it is
1598 possible to create your own ".conf" and ".tmpl" files and
1599 store them locally, outside the OpenSSL source tree.
1600 This environment variable can be set to the directory where
1601 these files are held and will be considered by Configure
1602 before it looks in the standard directories.
1605 The name of the Perl executable to use when building OpenSSL.
1606 Only needed if building should use a different Perl executable
1607 than what is used to run the Configure script.
1610 The name of the ranlib executable to use.
1613 The name of the rc executable to use. The default will be as
1614 defined for the target platform in the ".conf" file. If not
1615 defined then "windres" will be used. The WINDRES environment
1616 variable is synonymous to this. If both are defined then RC
1625 The `Configure` script generates a Makefile in a format relevant to the specific
1626 platform. The Makefiles provide a number of targets that can be used. Not all
1627 targets may be available on all platforms. Only the most common targets are
1628 described here. Examine the Makefiles themselves for the full list.
1631 The target to build all the software components and
1635 Build all the software components.
1636 THIS IS THE DEFAULT TARGET.
1639 Build all documentation components.
1642 Remove all build artefacts and return the directory to a "clean"
1646 Rebuild the dependencies in the Makefiles. This is a legacy
1647 option that no longer needs to be used since OpenSSL 1.1.0.
1650 Install all OpenSSL components.
1653 Only install the OpenSSL software components.
1656 Only install the OpenSSL documentation components.
1659 Only install the OpenSSL man pages (Unix only).
1662 Only install the OpenSSL HTML documentation.
1665 Install the FIPS provider module configuration file.
1668 Prints a list of all the self test names.
1671 Build and run the OpenSSL self tests.
1674 Uninstall all OpenSSL components.
1678 Re-run the configuration process, as exactly as the last time
1682 This is a developer option. If you are developing a patch for
1683 OpenSSL you may need to use this if you want to update
1684 automatically generated files; add new error codes or add new
1685 (or change the visibility of) public API functions. (Unix only).
1687 Running Selected Tests
1688 ----------------------
1690 You can specify a set of tests to be performed
1691 using the `make` variable `TESTS`.
1693 See the section [Running Selected Tests of
1694 test/README.md](test/README.md#running-selected-tests).
1699 Configuration Problems
1700 ----------------------
1702 ### Selecting the correct target
1704 The `./Configure` script tries hard to guess your operating system, but in some
1705 cases it does not succeed. You will see a message like the following:
1708 Operating system: x86-whatever-minix
1709 This system (minix) is not supported. See file INSTALL.md for details.
1711 Even if the automatic target selection by the `./Configure` script fails,
1712 chances are that you still might find a suitable target in the `Configurations`
1713 directory, which you can supply to the `./Configure` command,
1714 possibly after some adjustment.
1716 The `Configurations/` directory contains a lot of examples of such targets.
1717 The main configuration file is [10-main.conf], which contains all targets that
1718 are officially supported by the OpenSSL team. Other configuration files contain
1719 targets contributed by other OpenSSL users. The list of targets can be found in
1720 a Perl list `my %targets = ( ... )`.
1725 inherit_from => [ "base-target" ],
1727 cflags => add("..."),
1729 perlasm_scheme => "...",
1734 If you call `./Configure` without arguments, it will give you a list of all
1735 known targets. Using `grep`, you can lookup the target definition in the
1736 `Configurations/` directory. For example the `android-x86_64` can be found in
1737 [Configurations/15-android.conf](Configurations/15-android.conf).
1739 The directory contains two README files, which explain the general syntax and
1740 design of the configuration files.
1742 - [Configurations/README.md](Configurations/README.md)
1743 - [Configurations/README-design.md](Configurations/README-design.md)
1745 If you need further help, try to search the [openssl-users] mailing list
1746 or the [GitHub Issues] for existing solutions. If you don't find anything,
1747 you can [raise an issue] to ask a question yourself.
1749 More about our support resources can be found in the [SUPPORT] file.
1751 ### Configuration Errors
1753 If the `./Configure` or `./Configure` command fails with an error message,
1754 read the error message carefully and try to figure out whether you made
1755 a mistake (e.g., by providing a wrong option), or whether the script is
1756 working incorrectly. If you think you encountered a bug, please
1757 [raise an issue] on GitHub to file a bug report.
1759 Along with a short description of the bug, please provide the complete
1760 configure command line and the relevant output including the error message.
1762 Note: To make the output readable, please add a 'code fence' (three backquotes
1763 ` ``` ` on a separate line) before and after your output:
1766 ./Configure [your arguments...]
1775 If the build fails, look carefully at the output. Try to locate and understand
1776 the error message. It might be that the compiler is already telling you
1777 exactly what you need to do to fix your problem.
1779 There may be reasons for the failure that aren't problems in OpenSSL itself,
1780 for example if the compiler reports missing standard or third party headers.
1782 If the build succeeded previously, but fails after a source or configuration
1783 change, it might be helpful to clean the build tree before attempting another
1784 build. Use this command:
1787 $ mms clean ! (or mmk) OpenVMS
1788 $ nmake clean # Windows
1790 Assembler error messages can sometimes be sidestepped by using the `no-asm`
1791 configuration option. See also [notes](#notes-on-assembler-modules-compilation).
1793 Compiling parts of OpenSSL with gcc and others with the system compiler will
1794 result in unresolved symbols on some systems.
1796 If you are still having problems, try to search the [openssl-users] mailing
1797 list or the [GitHub Issues] for existing solutions. If you think you
1798 encountered an OpenSSL bug, please [raise an issue] to file a bug report.
1799 Please take the time to review the existing issues first; maybe the bug was
1800 already reported or has already been fixed.
1805 If some tests fail, look at the output. There may be reasons for the failure
1806 that isn't a problem in OpenSSL itself (like an OS malfunction or a Perl issue).
1808 You may want increased verbosity, that can be accomplished as described in
1809 section [Test Failures of test/README.md](test/README.md#test-failures).
1811 You may also want to selectively specify which test(s) to perform. This can be
1812 done using the `make` variable `TESTS` as described in section [Running
1813 Selected Tests of test/README.md](test/README.md#running-selected-tests).
1815 If you find a problem with OpenSSL itself, try removing any
1816 compiler optimization flags from the `CFLAGS` line in the Makefile and
1817 run `make clean; make` or corresponding.
1819 To report a bug please open an issue on GitHub, at
1820 <https://github.com/openssl/openssl/issues>.
1825 Notes on multi-threading
1826 ------------------------
1828 For some systems, the OpenSSL `Configure` script knows what compiler options
1829 are needed to generate a library that is suitable for multi-threaded
1830 applications. On these systems, support for multi-threading is enabled
1831 by default; use the `no-threads` option to disable (this should never be
1834 On other systems, to enable support for multi-threading, you will have
1835 to specify at least two options: `threads`, and a system-dependent option.
1836 (The latter is `-D_REENTRANT` on various systems.) The default in this
1837 case, obviously, is not to include support for multi-threading (but
1838 you can still use `no-threads` to suppress an annoying warning message
1839 from the `Configure` script.)
1841 OpenSSL provides built-in support for two threading models: pthreads (found on
1842 most UNIX/Linux systems), and Windows threads. No other threading models are
1843 supported. If your platform does not provide pthreads or Windows threads then
1844 you should use `Configure` with the `no-threads` option.
1846 For pthreads, all locks are non-recursive. In addition, in a debug build,
1847 the mutex attribute `PTHREAD_MUTEX_ERRORCHECK` is used. If this is not
1848 available on your platform, you might have to add
1849 `-DOPENSSL_NO_MUTEX_ERRORCHECK` to your `Configure` invocation.
1850 (On Linux `PTHREAD_MUTEX_ERRORCHECK` is an enum value, so a built-in
1851 ifdef test cannot be used.)
1853 Notes on shared libraries
1854 -------------------------
1856 For most systems the OpenSSL `Configure` script knows what is needed to
1857 build shared libraries for libcrypto and libssl. On these systems
1858 the shared libraries will be created by default. This can be suppressed and
1859 only static libraries created by using the `no-shared` option. On systems
1860 where OpenSSL does not know how to build shared libraries the `no-shared`
1861 option will be forced and only static libraries will be created.
1863 Shared libraries are named a little differently on different platforms.
1864 One way or another, they all have the major OpenSSL version number as
1865 part of the file name, i.e. for OpenSSL 1.1.x, `1.1` is somehow part of
1868 On most POSIX platforms, shared libraries are named `libcrypto.so.1.1`
1869 and `libssl.so.1.1`.
1871 on Cygwin, shared libraries are named `cygcrypto-1.1.dll` and `cygssl-1.1.dll`
1872 with import libraries `libcrypto.dll.a` and `libssl.dll.a`.
1874 On Windows build with MSVC or using MingW, shared libraries are named
1875 `libcrypto-1_1.dll` and `libssl-1_1.dll` for 32-bit Windows,
1876 `libcrypto-1_1-x64.dll` and `libssl-1_1-x64.dll` for 64-bit x86_64 Windows,
1877 and `libcrypto-1_1-ia64.dll` and `libssl-1_1-ia64.dll` for IA64 Windows.
1878 With MSVC, the import libraries are named `libcrypto.lib` and `libssl.lib`,
1879 while with MingW, they are named `libcrypto.dll.a` and `libssl.dll.a`.
1881 On VMS, shareable images (VMS speak for shared libraries) are named
1882 `ossl$libcrypto0101_shr.exe` and `ossl$libssl0101_shr.exe`. However, when
1883 OpenSSL is specifically built for 32-bit pointers, the shareable images
1884 are named `ossl$libcrypto0101_shr32.exe` and `ossl$libssl0101_shr32.exe`
1885 instead, and when built for 64-bit pointers, they are named
1886 `ossl$libcrypto0101_shr64.exe` and `ossl$libssl0101_shr64.exe`.
1888 Notes on random number generation
1889 ---------------------------------
1891 Availability of cryptographically secure random numbers is required for
1892 secret key generation. OpenSSL provides several options to seed the
1893 internal CSPRNG. If not properly seeded, the internal CSPRNG will refuse
1894 to deliver random bytes and a "PRNG not seeded error" will occur.
1896 The seeding method can be configured using the `--with-rand-seed` option,
1897 which can be used to specify a comma separated list of seed methods.
1898 However, in most cases OpenSSL will choose a suitable default method,
1899 so it is not necessary to explicitly provide this option. Note also
1900 that not all methods are available on all platforms. The FIPS provider will
1901 silently ignore seed sources that were not validated.
1903 I) On operating systems which provide a suitable randomness source (in
1904 form of a system call or system device), OpenSSL will use the optimal
1905 available method to seed the CSPRNG from the operating system's
1906 randomness sources. This corresponds to the option `--with-rand-seed=os`.
1908 II) On systems without such a suitable randomness source, automatic seeding
1909 and reseeding is disabled (`--with-rand-seed=none`) and it may be necessary
1910 to install additional support software to obtain a random seed and reseed
1911 the CSPRNG manually. Please check out the manual pages for `RAND_add()`,
1912 `RAND_bytes()`, `RAND_egd()`, and the FAQ for more information.
1914 Notes on assembler modules compilation
1915 --------------------------------------
1917 Compilation of some code paths in assembler modules might depend on whether the
1918 current assembler version supports certain ISA extensions or not. Code paths
1919 that use the AES-NI, PCLMULQDQ, SSSE3, and SHA extensions are always assembled.
1920 Apart from that, the minimum requirements for the assembler versions are shown
1923 | ISA extension | GNU as | nasm | llvm |
1924 |---------------|--------|--------|---------|
1925 | AVX | 2.19 | 2.09 | 3.0 |
1926 | AVX2 | 2.22 | 2.10 | 3.1 |
1927 | ADCX/ADOX | 2.23 | 2.10 | 3.3 |
1928 | AVX512 | 2.25 | 2.11.8 | 3.6 (*) |
1929 | AVX512IFMA | 2.26 | 2.11.8 | 6.0 (*) |
1930 | VAES | 2.30 | 2.13.3 | 6.0 (*) |
1934 (*) Even though AVX512 support was implemented in llvm 3.6, prior to version 7.0
1935 an explicit -march flag was apparently required to compile assembly modules. But
1936 then the compiler generates processor-specific code, which in turn contradicts
1937 the idea of performing dispatch at run-time, which is facilitated by the special
1938 variable `OPENSSL_ia32cap`. For versions older than 7.0, it is possible to work
1939 around the problem by forcing the build procedure to use the following script:
1942 exec clang -no-integrated-as "$@"
1944 instead of the real clang. In which case it doesn't matter what clang version
1945 is used, as it is the version of the GNU assembler that will be checked.
1952 <https://mta.openssl.org/mailman/listinfo/openssl-users>
1958 <https://github.com/openssl/openssl/issues>
1961 <https://github.com/openssl/openssl/issues/new/choose>
1964 Configurations/10-main.conf