1Build and Install 2================= 3 4This document describes installation on all supported operating 5systems: the Unix/Linux family (including macOS), OpenVMS, 6and Windows. 7 8Table of Contents 9================= 10 11 - [Prerequisites](#prerequisites) 12 - [Notational Conventions](#notational-conventions) 13 - [Quick Installation Guide](#quick-installation-guide) 14 - [Building OpenSSL](#building-openssl) 15 - [Installing OpenSSL](#installing-openssl) 16 - [Configuration Options](#configuration-options) 17 - [API Level](#api-level) 18 - [Cross Compile Prefix](#cross-compile-prefix) 19 - [Build Type](#build-type) 20 - [Directories](#directories) 21 - [Compiler Warnings](#compiler-warnings) 22 - [Compression Algorithm Flags](#compression-algorithm-flags) 23 - [Seeding the Random Generator](#seeding-the-random-generator) 24 - [Setting the FIPS HMAC key](#setting-the-FIPS-HMAC-key) 25 - [Enable and Disable Features](#enable-and-disable-features) 26 - [Displaying configuration data](#displaying-configuration-data) 27 - [Installation Steps in Detail](#installation-steps-in-detail) 28 - [Configure](#configure-openssl) 29 - [Build](#build-openssl) 30 - [Test](#test-openssl) 31 - [Install](#install-openssl) 32 - [Advanced Build Options](#advanced-build-options) 33 - [Environment Variables](#environment-variables) 34 - [Makefile Targets](#makefile-targets) 35 - [Running Selected Tests](#running-selected-tests) 36 - [Troubleshooting](#troubleshooting) 37 - [Configuration Problems](#configuration-problems) 38 - [Build Failures](#build-failures) 39 - [Test Failures](#test-failures) 40 - [Notes](#notes) 41 - [Notes on multi-threading](#notes-on-multi-threading) 42 - [Notes on shared libraries](#notes-on-shared-libraries) 43 - [Notes on random number generation](#notes-on-random-number-generation) 44 - [Notes on assembler modules compilation](#notes-on-assembler-modules-compilation) 45 46Prerequisites 47============= 48 49To install OpenSSL, you will need: 50 51 * A "make" implementation 52 * Perl 5 with core modules (please read [NOTES-PERL.md](NOTES-PERL.md)) 53 * The Perl module `Text::Template` (please read [NOTES-PERL.md](NOTES-PERL.md)) 54 * an ANSI C compiler 55 * POSIX C library (at least POSIX.1-2008), or compatible types and 56 functionality. 57 * a development environment in the form of development libraries and C 58 header files 59 * a supported operating system 60 61For additional platform specific requirements, solutions to specific 62issues and other details, please read one of these: 63 64 * [Notes for UNIX-like platforms](NOTES-UNIX.md) 65 * [Notes for Android platforms](NOTES-ANDROID.md) 66 * [Notes for Windows platforms](NOTES-WINDOWS.md) 67 * [Notes for the DOS platform with DJGPP](NOTES-DJGPP.md) 68 * [Notes for the OpenVMS platform](NOTES-VMS.md) 69 * [Notes for the HPE NonStop platform](NOTES-NONSTOP.md) 70 * [Notes on POSIX](NOTES-POSIX.md) 71 * [Notes on Perl](NOTES-PERL.md) 72 * [Notes on Valgrind](NOTES-VALGRIND.md) 73 74Notational conventions 75====================== 76 77Throughout this document, we use the following conventions. 78 79Commands 80-------- 81 82Any line starting with a dollar sign is a command line. 83 84 $ command 85 86The dollar sign indicates the shell prompt and is not to be entered as 87part of the command. 88 89Choices 90------- 91 92Several words in curly braces separated by pipe characters indicate a 93**mandatory choice**, to be replaced with one of the given words. 94For example, the line 95 96 $ echo { WORD1 | WORD2 | WORD3 } 97 98represents one of the following three commands 99 100 $ echo WORD1 101 - or - 102 $ echo WORD2 103 - or - 104 $ echo WORD3 105 106One or several words in square brackets separated by pipe characters 107denote an **optional choice**. It is similar to the mandatory choice, 108but it can also be omitted entirely. 109 110So the line 111 112 $ echo [ WORD1 | WORD2 | WORD3 ] 113 114represents one of the four commands 115 116 $ echo WORD1 117 - or - 118 $ echo WORD2 119 - or - 120 $ echo WORD3 121 - or - 122 $ echo 123 124Arguments 125--------- 126 127**Optional Arguments** are enclosed in square brackets. 128 129 [option...] 130 131A trailing ellipsis means that more than one could be specified. 132 133Quick Installation Guide 134======================== 135 136If you just want to get OpenSSL installed without bothering too much 137about the details, here is the short version of how to build and install 138OpenSSL. If any of the following steps fails, please consult the 139[Installation in Detail](#installation-steps-in-detail) section below. 140 141Building OpenSSL 142---------------- 143 144Use the following commands to configure, build and test OpenSSL. 145The testing is optional, but recommended if you intend to install 146OpenSSL for production use. 147 148### Unix / Linux / macOS / NonStop 149 150 $ ./Configure 151 $ make 152 $ make test 153 154### OpenVMS 155 156Use the following commands to build OpenSSL: 157 158 $ perl Configure 159 $ mms 160 $ mms test 161 162### Windows 163 164If you are using Visual Studio, open a Developer Command Prompt and 165issue the following commands to build OpenSSL. 166 167 $ perl Configure 168 $ nmake 169 $ nmake test 170 171As mentioned in the [Choices](#choices) section, you need to pick one 172of the four Configure targets in the first command. 173 174Most likely you will be using the `VC-WIN64A`/`VC-WIN64A-HYBRIDCRT` target for 17564bit Windows binaries (AMD64) or `VC-WIN32`/`VC-WIN32-HYBRIDCRT` for 32bit 176Windows binaries (X86). 177The other two options are `VC-WIN64I` (Intel IA64, Itanium) and 178`VC-CE` (Windows CE) are rather uncommon nowadays. 179 180Installing OpenSSL 181------------------ 182 183The following commands will install OpenSSL to a default system location. 184 185**Danger Zone:** even if you are impatient, please read the following two 186paragraphs carefully before you install OpenSSL. 187 188For security reasons the default system location is by default not writable 189for unprivileged users. So for the final installation step administrative 190privileges are required. The default system location and the procedure to 191obtain administrative privileges depends on the operating system. 192It is recommended to compile and test OpenSSL with normal user privileges 193and use administrative privileges only for the final installation step. 194 195On some platforms OpenSSL is preinstalled as part of the Operating System. 196In this case it is highly recommended not to overwrite the system versions, 197because other applications or libraries might depend on it. 198To avoid breaking other applications, install your copy of OpenSSL to a 199[different location](#installing-to-a-different-location) which is not in 200the global search path for system libraries. 201 202Finally, if you plan on using the FIPS module, you need to read the 203[Post-installation Notes](#post-installation-notes) further down. 204 205### Unix / Linux / macOS / NonStop 206 207Depending on your distribution, you need to run the following command as 208root user or prepend `sudo` to the command: 209 210 $ make install 211 212By default, OpenSSL will be installed to 213 214 /usr/local 215 216More precisely, the files will be installed into the subdirectories 217 218 /usr/local/bin 219 /usr/local/lib 220 /usr/local/include 221 ... 222 223depending on the file type, as it is custom on Unix-like operating systems. 224 225### OpenVMS 226 227Use the following command to install OpenSSL. 228 229 $ mms install 230 231By default, OpenSSL will be installed to 232 233 SYS$COMMON:[OPENSSL] 234 235### Windows 236 237If you are using Visual Studio, open the Developer Command Prompt _elevated_ 238and issue the following command. 239 240 $ nmake install 241 242The easiest way to elevate the Command Prompt is to press and hold down both 243the `<CTRL>` and `<SHIFT>` keys while clicking the menu item in the task menu. 244 245The default installation location is 246 247 C:\Program Files\OpenSSL 248 249for native binaries, or 250 251 C:\Program Files (x86)\OpenSSL 252 253for 32bit binaries on 64bit Windows (WOW64). 254 255#### Installing to a different location 256 257To install OpenSSL to a different location (for example into your home 258directory for testing purposes) run `Configure` as shown in the following 259examples. 260 261The options `--prefix` and `--openssldir` are explained in further detail in 262[Directories](#directories) below, and the values used here are mere examples. 263 264On Unix: 265 266 $ ./Configure --prefix=/opt/openssl --openssldir=/usr/local/ssl 267 268On OpenVMS: 269 270 $ perl Configure --prefix=PROGRAM:[INSTALLS] --openssldir=SYS$MANAGER:[OPENSSL] 271 272Note: if you do add options to the configuration command, please make sure 273you've read more than just this Quick Start, such as relevant `NOTES-*` files, 274the options outline below, as configuration options may change the outcome 275in otherwise unexpected ways. 276 277Configuration Options 278===================== 279 280There are several options to `./Configure` to customize the build (note that 281for Windows, the defaults for `--prefix` and `--openssldir` depend on what 282configuration is used and what Windows implementation OpenSSL is built on. 283For more information, see the [Notes for Windows platforms](NOTES-WINDOWS.md). 284 285API Level 286--------- 287 288 --api=x.y[.z] 289 290Build the OpenSSL libraries to support the API for the specified version. 291If [no-deprecated](#no-deprecated) is also given, don't build with support 292for deprecated APIs in or below the specified version number. For example, 293adding 294 295 --api=1.1.0 no-deprecated 296 297will remove support for all APIs that were deprecated in OpenSSL version 2981.1.0 or below. This is a rather specialized option for developers. 299If you just intend to remove all deprecated APIs up to the current version 300entirely, just specify [no-deprecated](#no-deprecated). 301If `--api` isn't given, it defaults to the current (minor) OpenSSL version. 302 303Cross Compile Prefix 304-------------------- 305 306 --cross-compile-prefix=<PREFIX> 307 308The `<PREFIX>` to include in front of commands for your toolchain. 309 310It is likely to have to end with dash, e.g. `a-b-c-` would invoke GNU compiler 311as `a-b-c-gcc`, etc. Unfortunately cross-compiling is too case-specific to put 312together one-size-fits-all instructions. You might have to pass more flags or 313set up environment variables to actually make it work. Android and iOS cases 314are discussed in corresponding `Configurations/15-*.conf` files. But there are 315cases when this option alone is sufficient. For example to build the mingw64 316target on Linux `--cross-compile-prefix=x86_64-w64-mingw32-` works. Naturally 317provided that mingw packages are installed. Today Debian and Ubuntu users 318have option to install a number of prepackaged cross-compilers along with 319corresponding run-time and development packages for "alien" hardware. To give 320another example `--cross-compile-prefix=mipsel-linux-gnu-` suffices in such 321case. 322 323For cross compilation, you must [configure manually](#manual-configuration). 324Also, note that `--openssldir` refers to target's file system, not one you are 325building on. 326 327Build Type 328---------- 329 330 --debug 331 332Build OpenSSL with debugging symbols and zero optimization level. 333 334 --release 335 336Build OpenSSL without debugging symbols. This is the default. 337 338Directories 339----------- 340 341### libdir 342 343 --libdir=DIR 344 345The name of the directory under the top of the installation directory tree 346(see the `--prefix` option) where libraries will be installed. By default 347this is `lib`. Note that on Windows only static libraries (`*.lib`) will 348be stored in this location. Shared libraries (`*.dll`) will always be 349installed to the `bin` directory. 350 351Some build targets have a multilib postfix set in the build configuration. 352For these targets the default libdir is `lib<multilib-postfix>`. Please use 353`--libdir=lib` to override the libdir if adding the postfix is undesirable. 354 355### openssldir 356 357 --openssldir=DIR 358 359Directory for OpenSSL configuration files, and also the default certificate 360and key store. Defaults are: 361 362 Unix: /usr/local/ssl 363 Windows: C:\Program Files\Common Files\SSL 364 OpenVMS: SYS$COMMON:[OPENSSL-COMMON] 365 366For 32bit Windows applications on Windows 64bit (WOW64), always replace 367`C:\Program Files` by `C:\Program Files (x86)`. 368 369### prefix 370 371 --prefix=DIR 372 373The top of the installation directory tree. Defaults are: 374 375 Unix: /usr/local 376 Windows: C:\Program Files\OpenSSL 377 OpenVMS: SYS$COMMON:[OPENSSL] 378 379Compiler Warnings 380----------------- 381 382 --strict-warnings 383 384This is a developer flag that switches on various compiler options recommended 385for OpenSSL development. It only works when using gcc or clang as the compiler. 386If you are developing a patch for OpenSSL then it is recommended that you use 387this option where possible. 388 389Compression Algorithm Flags 390--------------------------- 391 392### with-brotli-include 393 394 --with-brotli-include=DIR 395 396The directory for the location of the brotli include files (i.e. the location 397of the **brotli** include directory). This option is only necessary if 398[enable-brotli](#enable-brotli) is used and the include files are not already 399on the system include path. 400 401### with-brotli-lib 402 403 --with-brotli-lib=LIB 404 405**On Unix**: this is the directory containing the brotli libraries. 406If not provided, the system library path will be used. 407 408The names of the libraries are: 409 410* libbrotlicommon.a or libbrotlicommon.so 411* libbrotlidec.a or libbrotlidec.so 412* libbrotlienc.a or libbrotlienc.so 413 414**On Windows:** this is the directory containing the brotli libraries. 415If not provided, the system library path will be used. 416 417The names of the libraries are: 418 419* brotlicommon.lib 420* brotlidec.lib 421* brotlienc.lib 422 423### with-zlib-include 424 425 --with-zlib-include=DIR 426 427The directory for the location of the zlib include file. This option is only 428necessary if [zlib](#zlib) is used and the include file is not 429already on the system include path. 430 431### with-zlib-lib 432 433 --with-zlib-lib=LIB 434 435**On Unix**: this is the directory containing the zlib library. 436If not provided the system library path will be used. 437 438**On Windows:** this is the filename of the zlib library (with or 439without a path). This flag must be provided if the 440[zlib-dynamic](#zlib-dynamic) option is not also used. If `zlib-dynamic` is used 441then this flag is optional and defaults to `ZLIB1` if not provided. 442 443**On VMS:** this is the filename of the zlib library (with or without a path). 444This flag is optional and if not provided then `GNV$LIBZSHR`, `GNV$LIBZSHR32` 445or `GNV$LIBZSHR64` is used by default depending on the pointer size chosen. 446 447### with-zstd-include 448 449 --with-zstd-include=DIR 450 451The directory for the location of the Zstd include file. This option is only 452necessary if [enable-std](#enable-zstd) is used and the include file is not 453already on the system include path. 454 455OpenSSL requires Zstd 1.4 or greater. The Linux kernel source contains a 456*zstd.h* file that is not compatible with the 1.4.x Zstd distribution, the 457compilation will generate an error if the Linux *zstd.h* is included before 458(or instead of) the Zstd distribution header. 459 460### with-zstd-lib 461 462 --with-zstd-lib=LIB 463 464**On Unix**: this is the directory containing the Zstd library. 465If not provided the system library path will be used. 466 467**On Windows:** this is the filename of the Zstd library (with or 468without a path). This flag must be provided if the 469[enable-zstd-dynamic](#enable-zstd-dynamic) option is not also used. 470If `zstd-dynamic` is used then this flag is optional and defaults 471to `LIBZSTD` if not provided. 472 473Seeding the Random Generator 474---------------------------- 475 476 --with-rand-seed=seed1[,seed2,...] 477 478A comma separated list of seeding methods which will be tried by OpenSSL 479in order to obtain random input (a.k.a "entropy") for seeding its 480cryptographically secure random number generator (CSPRNG). 481The current seeding methods are: 482 483### os 484 485Use a trusted operating system entropy source. 486This is the default method if such an entropy source exists. 487 488### getrandom 489 490Use the [getrandom(2)][man-getrandom] or equivalent system call. 491 492[man-getrandom]: http://man7.org/linux/man-pages/man2/getrandom.2.html 493 494### devrandom 495 496Use the first device from the `DEVRANDOM` list which can be opened to read 497random bytes. The `DEVRANDOM` preprocessor constant expands to 498 499 "/dev/urandom","/dev/random","/dev/srandom" 500 501on most unix-ish operating systems. 502 503### egd 504 505Check for an entropy generating daemon. 506This source is ignored by the FIPS provider. 507 508### rdcpu 509 510Use the `RDSEED` or `RDRAND` command on x86 or `RNDRRS` command on aarch64 511if provided by the CPU. 512 513### none 514 515Disable automatic seeding. This is the default on some operating systems where 516no suitable entropy source exists, or no support for it is implemented yet. 517This option is ignored by the FIPS provider. 518 519For more information, see the section [Notes on random number generation][rng] 520at the end of this document. 521 522[rng]: #notes-on-random-number-generation 523 524### jitter 525 526When configured with `enable-jitter`, a "JITTER" RNG is compiled that 527can provide an alternative software seed source. It can be configured 528by setting `seed` option in `openssl.cnf`. A minimal `openssl.cnf` is 529shown below: 530 531 openssl_conf = openssl_init 532 533 [openssl_init] 534 random = random 535 536 [random] 537 seed=JITTER 538 539It uses a statically linked [jitterentropy-library] as the seed source. 540 541Additional configuration flags available: 542 543 --with-jitter-include=DIR 544 545The directory for the location of the jitterentropy.h include file, if 546it is outside the system include path. 547 548 --with-jitter-lib=DIR 549 550This is the directory containing the static libjitterentropy.a 551library, if it is outside the system library path. 552 553Setting the FIPS HMAC key 554------------------------- 555 556 --fips-key=value 557 558As part of its self-test validation, the FIPS module must verify itself 559by performing a SHA-256 HMAC computation on itself. The default key is 560the SHA256 value of "holy hand grenade of antioch" and is sufficient 561for meeting the FIPS requirements. 562 563To change the key to a different value, use this flag. The value should 564be a hex string no more than 64 characters. 565 566Enable and Disable Features 567--------------------------- 568 569Feature options always come in pairs, an option to enable feature 570`xxxx`, and an option to disable it: 571 572 [ enable-xxxx | no-xxxx ] 573 574Whether a feature is enabled or disabled by default, depends on the feature. 575In the following list, always the non-default variant is documented: if 576feature `xxxx` is disabled by default then `enable-xxxx` is documented and 577if feature `xxxx` is enabled by default then `no-xxxx` is documented. 578 579### no-afalgeng 580 581Don't build the AFALG engine. 582 583This option will be forced on a platform that does not support AFALG. 584 585### enable-ktls 586 587Build with Kernel TLS support. 588 589This option will enable the use of the Kernel TLS data-path, which can improve 590performance and allow for the use of sendfile and splice system calls on 591TLS sockets. The Kernel may use TLS accelerators if any are available on the 592system. This option will be forced off on systems that do not support the 593Kernel TLS data-path. 594 595### enable-asan 596 597Build with the Address sanitiser. 598 599This is a developer option only. It may not work on all platforms and should 600never be used in production environments. It will only work when used with 601gcc or clang and should be used in conjunction with the [no-shared](#no-shared) 602option. 603 604### enable-acvp-tests 605 606Build support for Automated Cryptographic Validation Protocol (ACVP) 607tests. 608 609This is required for FIPS validation purposes. Certain ACVP tests require 610access to algorithm internals that are not normally accessible. 611Additional information related to ACVP can be found at 612<https://github.com/usnistgov/ACVP>. 613 614### no-apps 615 616Do not build apps, e.g. the openssl program. This is handy for minimization. 617This option also disables tests. 618 619### no-asm 620 621Do not use assembler code. 622 623This should be viewed as debugging/troubleshooting option rather than for 624production use. On some platforms a small amount of assembler code may still 625be used even with this option. 626 627### no-async 628 629Do not build support for async operations. 630 631### no-atexit 632 633Do not use `atexit()` in libcrypto builds. 634 635`atexit()` has varied semantics between platforms and can cause SIGSEGV in some 636circumstances. This option disables the atexit registration of OPENSSL_cleanup. 637By default, NonStop configurations use `no-atexit`. 638 639### no-autoalginit 640 641Don't automatically load all supported ciphers and digests. 642 643Typically OpenSSL will make available all of its supported ciphers and digests. 644For a statically linked application this may be undesirable if small executable 645size is an objective. This only affects libcrypto. Ciphers and digests will 646have to be loaded manually using `EVP_add_cipher()` and `EVP_add_digest()` 647if this option is used. This option will force a non-shared build. 648 649### no-autoerrinit 650 651Don't automatically load all libcrypto/libssl error strings. 652 653Typically OpenSSL will automatically load human readable error strings. For a 654statically linked application this may be undesirable if small executable size 655is an objective. 656 657### enable-brotli 658 659Build with support for brotli compression/decompression. 660 661### enable-brotli-dynamic 662 663Like the enable-brotli option, but has OpenSSL load the brotli library dynamically 664when needed. 665 666This is only supported on systems where loading of shared libraries is supported. 667 668### no-autoload-config 669 670Don't automatically load the default `openssl.cnf` file. 671 672Typically OpenSSL will automatically load a system config file which configures 673default SSL options. 674 675### enable-buildtest-c++ 676 677While testing, generate C++ buildtest files that simply check that the public 678OpenSSL header files are usable standalone with C++. 679 680Enabling this option demands extra care. For any compiler flag given directly 681as configuration option, you must ensure that it's valid for both the C and 682the C++ compiler. If not, the C++ build test will most likely break. As an 683alternative, you can use the language specific variables, `CFLAGS` and `CXXFLAGS`. 684 685### --banner=text 686 687Use the specified text instead of the default banner at the end of 688configuration. 689 690### --w 691 692On platforms where the choice of 32-bit or 64-bit architecture 693is not explicitly specified, `Configure` will print a warning 694message and wait for a few seconds to let you interrupt the 695configuration. Using this flag skips the wait. 696 697### no-bulk 698 699Build only some minimal set of features. 700This is a developer option used internally for CI build tests of the project. 701 702### no-cached-fetch 703 704Never cache algorithms when they are fetched from a provider. Normally, a 705provider indicates if the algorithms it supplies can be cached or not. Using 706this option will reduce run-time memory usage but it also introduces a 707significant performance penalty. This option is primarily designed to help 708with detecting incorrect reference counting. 709 710### no-capieng 711 712Don't build the CAPI engine. 713 714This option will be forced if on a platform that does not support CAPI. 715 716### no-cmp 717 718Don't build support for Certificate Management Protocol (CMP) 719and Certificate Request Message Format (CRMF). 720 721### no-cms 722 723Don't build support for Cryptographic Message Syntax (CMS). 724 725### no-comp 726 727Don't build support for SSL/TLS compression. 728 729If this option is enabled (the default), then compression will only work if 730the zlib or `zlib-dynamic` options are also chosen. 731 732### enable-crypto-mdebug 733 734This now only enables the `failed-malloc` feature. 735 736### enable-crypto-mdebug-backtrace 737 738This is a no-op; the project uses the compiler's address/leak sanitizer instead. 739 740### no-ct 741 742Don't build support for Certificate Transparency (CT). 743 744### no-deprecated 745 746Don't build with support for deprecated APIs up until and including the version 747given with `--api` (or the current version, if `--api` wasn't specified). 748 749### no-dgram 750 751Don't build support for datagram based BIOs. 752 753Selecting this option will also force the disabling of DTLS. 754 755### no-docs 756 757Don't build and install documentation, i.e. manual pages in various forms. 758 759### no-dso 760 761Don't build support for loading Dynamic Shared Objects (DSO) 762 763### enable-devcryptoeng 764 765Build the `/dev/crypto` engine. 766 767This option is automatically selected on the BSD platform, in which case it can 768be disabled with `no-devcryptoeng`. 769 770### no-dynamic-engine 771 772Don't build the dynamically loaded engines. 773 774This only has an effect in a shared build. 775 776### no-ec 777 778Don't build support for Elliptic Curves. 779 780### no-ec2m 781 782Don't build support for binary Elliptic Curves 783 784### enable-ec_nistp_64_gcc_128 785 786Enable support for optimised implementations of some commonly used NIST 787elliptic curves. 788 789This option is only supported on platforms: 790 791 - with little-endian storage of non-byte types 792 - that tolerate misaligned memory references 793 - where the compiler: 794 - supports the non-standard type `__uint128_t` 795 - defines the built-in macro `__SIZEOF_INT128__` 796 797### enable-egd 798 799Build support for gathering entropy from the Entropy Gathering Daemon (EGD). 800 801### no-engine 802 803Don't build support for loading engines. 804 805### no-err 806 807Don't compile in any error strings. 808 809### enable-external-tests 810 811Enable building of integration with external test suites. 812 813This is a developer option and may not work on all platforms. The following 814external test suites are currently supported: 815 816 - GOST engine test suite 817 - Python PYCA/Cryptography test suite 818 - krb5 test suite 819 820See the file [test/README-external.md](test/README-external.md) 821for further details. 822 823### no-filenames 824 825Don't compile in filename and line number information (e.g. for errors and 826memory allocation). 827 828### enable-fips 829 830Build (and install) the FIPS provider 831 832### no-fips-securitychecks 833 834Don't perform FIPS module run-time checks related to enforcement of security 835parameters such as minimum security strength of keys. 836 837### no-fips-post 838 839Don't perform FIPS module Power On Self Tests. 840 841This option MUST be used for debugging only as it makes the FIPS provider 842non-compliant. It is useful when setting breakpoints in FIPS algorithms. 843 844### enable-fips-jitter 845 846Use the CPU Jitter library as a FIPS validated entropy source. 847 848This option will only produce a compliant FIPS provider if you have: 849 8501. independently performed the required [SP 800-90B] entropy assessments; 8512. meet the minimum required entropy as specified by [jitterentropy-library]; 8523. obtain an [ESV] certificate for the [jitterentropy-library] and 8534. have had the resulting FIPS provider certified by the [CMVP]. 854 855Failure to do all of these will produce a non-compliant FIPS provider. 856 857### enable-fuzz-libfuzzer, enable-fuzz-afl 858 859Build with support for fuzzing using either libfuzzer or AFL. 860 861These are developer options only. They may not work on all platforms and 862should never be used in production environments. 863 864See the file [fuzz/README.md](fuzz/README.md) for further details. 865 866### no-gost 867 868Don't build support for GOST based ciphersuites. 869 870Note that if this feature is enabled then GOST ciphersuites are only available 871if the GOST algorithms are also available through loading an externally supplied 872engine. 873 874### no-http 875 876Disable HTTP support. 877 878### no-legacy 879 880Don't build the legacy provider. 881 882Disabling this also disables the legacy algorithms: MD2 (already disabled by default). 883 884### no-makedepend 885 886Don't generate dependencies. 887 888### no-module 889 890Don't build any dynamically loadable engines. 891 892This also implies `no-dynamic-engine`. 893 894### no-multiblock 895 896Don't build support for writing multiple records in one go in libssl 897 898Note: this is a different capability to the pipelining functionality. 899 900### no-nextprotoneg 901 902Don't build support for the Next Protocol Negotiation (NPN) TLS extension. 903 904### no-ocsp 905 906Don't build support for Online Certificate Status Protocol (OCSP). 907 908### no-padlockeng 909 910Don't build the padlock engine. 911 912### no-hw-padlock 913 914As synonym for `no-padlockeng`. Deprecated and should not be used. 915 916### no-pic 917 918Don't build with support for Position Independent Code. 919 920### enable-pie 921 922Build with support for Position Independent Execution. 923 924### no-pinshared 925 926Don't pin the shared libraries. 927 928By default OpenSSL will attempt to stay in memory until the process exits. 929This is so that libcrypto and libssl can be properly cleaned up automatically 930via an `atexit()` handler. The handler is registered by libcrypto and cleans 931up both libraries. On some platforms the `atexit()` handler will run on unload of 932libcrypto (if it has been dynamically loaded) rather than at process exit. 933 934This option can be used to stop OpenSSL from attempting to stay in memory until the 935process exits. This could lead to crashes if either libcrypto or libssl have 936already been unloaded at the point that the atexit handler is invoked, e.g. on a 937platform which calls `atexit()` on unload of the library, and libssl is unloaded 938before libcrypto then a crash is likely to happen. 939 940Note that shared library pinning is not automatically disabled for static builds, 941i.e., `no-shared` does not imply `no-pinshared`. This may come as a surprise when 942linking libcrypto statically into a shared third-party library, because in this 943case the shared library will be pinned. To prevent this behaviour, you need to 944configure the static build using `no-shared` and `no-pinshared` together. 945 946Applications can suppress running of the `atexit()` handler at run time by 947using the `OPENSSL_INIT_NO_ATEXIT` option to `OPENSSL_init_crypto()`. 948See the man page for it for further details. 949 950### no-posix-io 951 952Don't use POSIX IO capabilities. 953 954### no-psk 955 956Don't build support for Pre-Shared Key based ciphersuites. 957 958### no-rdrand 959 960Don't use hardware RDRAND capabilities. 961 962### no-rfc3779 963 964Don't build support for RFC3779, "X.509 Extensions for IP Addresses and 965AS Identifiers". 966 967### sctp 968 969Build support for Stream Control Transmission Protocol (SCTP). 970 971### no-shared 972 973Do not create shared libraries, only static ones. 974 975See [Notes on shared libraries](#notes-on-shared-libraries) below. 976 977### no-sm2-precomp 978 979Disable using the SM2 precomputed table on aarch64 to make the library smaller. 980 981### no-sock 982 983Don't build support for socket BIOs. 984 985### no-srp 986 987Don't build support for Secure Remote Password (SRP) protocol or 988SRP based ciphersuites. 989 990### no-srtp 991 992Don't build Secure Real-Time Transport Protocol (SRTP) support. 993 994### no-sse2 995 996Exclude SSE2 code paths from 32-bit x86 assembly modules. 997 998Normally SSE2 extension is detected at run-time, but the decision whether or not 999the machine code will be executed is taken solely on CPU capability vector. This 1000means that if you happen to run OS kernel which does not support SSE2 extension 1001on Intel P4 processor, then your application might be exposed to "illegal 1002instruction" exception. There might be a way to enable support in kernel, e.g. 1003FreeBSD kernel can be compiled with `CPU_ENABLE_SSE`, and there is a way to 1004disengage SSE2 code paths upon application start-up, but if you aim for wider 1005"audience" running such kernel, consider `no-sse2`. Both the `386` and `no-asm` 1006options imply `no-sse2`. 1007 1008### no-ssl-trace 1009 1010Don't build with SSL Trace capabilities. 1011 1012This removes the `-trace` option from `s_client` and `s_server`, and omits the 1013`SSL_trace()` function from libssl. 1014 1015Disabling `ssl-trace` may provide a small reduction in libssl binary size. 1016 1017### no-static-engine 1018 1019Don't build the statically linked engines. 1020 1021This only has an impact when not built "shared". 1022 1023### no-stdio 1024 1025Don't use anything from the C header file `stdio.h` that makes use of the `FILE` 1026type. Only libcrypto and libssl can be built in this way. Using this option will 1027suppress building the command line applications. Additionally, since the OpenSSL 1028tests also use the command line applications, the tests will also be skipped. 1029 1030### no-tests 1031 1032Don't build test programs or run any tests. 1033 1034### enable-tfo 1035 1036Build with support for TCP Fast Open (RFC7413). Supported on Linux, macOS and FreeBSD. 1037 1038### no-quic 1039 1040Don't build with QUIC support. 1041 1042### no-threads 1043 1044Don't build with support for multi-threaded applications. 1045 1046### threads 1047 1048Build with support for multi-threaded applications. Most platforms will enable 1049this by default. However, if on a platform where this is not the case then this 1050will usually require additional system-dependent options! 1051 1052See [Notes on multi-threading](#notes-on-multi-threading) below. 1053 1054### no-thread-pool 1055 1056Don't build with support for thread pool functionality. 1057 1058### thread-pool 1059 1060Build with thread pool functionality. If enabled, OpenSSL algorithms may 1061use the thread pool to perform parallel computation. This option in itself 1062does not enable OpenSSL to spawn new threads. Currently the only supported 1063thread pool mechanism is the default thread pool. 1064 1065### no-default-thread-pool 1066 1067Don't build with support for default thread pool functionality. 1068 1069### default-thread-pool 1070 1071Build with default thread pool functionality. If enabled, OpenSSL may create 1072and manage threads up to a maximum number of threads authorized by the 1073application. Supported on POSIX compliant platforms and Windows. 1074 1075### enable-trace 1076 1077Build with support for the integrated tracing api. 1078 1079See manual pages OSSL_trace_set_channel(3) and OSSL_trace_enabled(3) for details. 1080 1081### enable-sslkeylog 1082 1083Build with support for the SSLKEYLOGFILE environment variable 1084 1085When enabled, setting SSLKEYLOGFILE to a file path records the keys exchanged 1086during a TLS handshake for use in analysis tools like wireshark. Note that the 1087use of this mechanism allows for decryption of application payloads found in 1088captured packets using keys from the key log file and therefore has significant 1089security consequences. See Section 3 of 1090[the draft standard for SSLKEYLOGFILE](https://datatracker.ietf.org/doc/draft-ietf-tls-keylogfile/) 1091 1092### no-ts 1093 1094Don't build Time Stamping (TS) Authority support. 1095 1096### enable-ubsan 1097 1098Build with the Undefined Behaviour sanitiser (UBSAN). 1099 1100This is a developer option only. It may not work on all platforms and should 1101never be used in production environments. It will only work when used with 1102gcc or clang and should be used in conjunction with the `-DPEDANTIC` option 1103(or the `--strict-warnings` option). 1104 1105### no-ui-console 1106 1107Don't build with the User Interface (UI) console method 1108 1109The User Interface console method enables text based console prompts. 1110 1111### enable-unit-test 1112 1113Enable additional unit test APIs. 1114 1115This should not typically be used in production deployments. 1116 1117### no-uplink 1118 1119Don't build support for UPLINK interface. 1120 1121### enable-weak-ssl-ciphers 1122 1123Build support for SSL/TLS ciphers that are considered "weak" 1124 1125Enabling this includes for example the RC4 based ciphersuites. 1126 1127### zlib 1128 1129Build with support for zlib compression/decompression. 1130 1131### zlib-dynamic 1132 1133Like the zlib option, but has OpenSSL load the zlib library dynamically 1134when needed. 1135 1136This is only supported on systems where loading of shared libraries is supported. 1137 1138### enable-zstd 1139 1140Build with support for Zstd compression/decompression. 1141 1142### enable-zstd-dynamic 1143 1144Like the enable-zstd option, but has OpenSSL load the Zstd library dynamically 1145when needed. 1146 1147This is only supported on systems where loading of shared libraries is supported. 1148 1149### enable-unstable-qlog 1150 1151Enables qlog output support for the QUIC protocol. This functionality is 1152unstable and implements a draft version of the qlog specification. The qlog 1153output from OpenSSL will change in incompatible ways in future, and is not 1154subject to any format stability or compatibility guarantees at this time. See 1155the manpage openssl-qlog(7) for details. 1156 1157### 386 1158 1159In 32-bit x86 builds, use the 80386 instruction set only in assembly modules 1160 1161The default x86 code is more efficient, but requires at least an 486 processor. 1162Note: This doesn't affect compiler generated code, so this option needs to be 1163accompanied by a corresponding compiler-specific option. 1164 1165### no-{protocol} 1166 1167 no-{ssl|ssl3|tls|tls1|tls1_1|tls1_2|tls1_3|dtls|dtls1|dtls1_2} 1168 1169Don't build support for negotiating the specified SSL/TLS protocol. 1170 1171If `no-tls` is selected then all of `tls1`, `tls1_1`, `tls1_2` and `tls1_3` 1172are disabled. 1173Similarly `no-dtls` will disable `dtls1` and `dtls1_2`. The `no-ssl` option is 1174synonymous with `no-ssl3`. Note this only affects version negotiation. 1175OpenSSL will still provide the methods for applications to explicitly select 1176the individual protocol versions. 1177 1178### no-integrity-only-ciphers 1179 1180Don't build support for integrity only ciphers in tls. 1181 1182### no-{protocol}-method 1183 1184 no-{ssl3|tls1|tls1_1|tls1_2|dtls1|dtls1_2}-method 1185 1186Analogous to `no-{protocol}` but in addition do not build the methods for 1187applications to explicitly select individual protocol versions. Note that there 1188is no `no-tls1_3-method` option because there is no application method for 1189TLSv1.3. 1190 1191Using individual protocol methods directly is deprecated. Applications should 1192use `TLS_method()` instead. 1193 1194### enable-{algorithm} 1195 1196 enable-{md2|rc5} 1197 1198Build with support for the specified algorithm. 1199 1200### no-{algorithm} 1201 1202 no-{aria|bf|blake2|camellia|cast|chacha|cmac| 1203 des|dh|dsa|ecdh|ecdsa|idea|md4|mdc2|ocb| 1204 poly1305|rc2|rc4|rmd160|scrypt|seed| 1205 siphash|siv|sm2|sm3|sm4|whirlpool} 1206 1207Build without support for the specified algorithm. 1208 1209The `ripemd` algorithm is deprecated and if used is synonymous with `rmd160`. 1210 1211### Compiler-specific options 1212 1213 -Dxxx, -Ixxx, -Wp, -lxxx, -Lxxx, -Wl, -rpath, -R, -framework, -static 1214 1215These system specific options will be recognised and passed through to the 1216compiler to allow you to define preprocessor symbols, specify additional 1217libraries, library directories or other compiler options. It might be worth 1218noting that some compilers generate code specifically for processor the 1219compiler currently executes on. This is not necessarily what you might have 1220in mind, since it might be unsuitable for execution on other, typically older, 1221processor. Consult your compiler documentation. 1222 1223Take note of the [Environment Variables](#environment-variables) documentation 1224below and how these flags interact with those variables. 1225 1226 -xxx, +xxx, /xxx 1227 1228Additional options that are not otherwise recognised are passed through as 1229they are to the compiler as well. Unix-style options beginning with a 1230`-` or `+` and Windows-style options beginning with a `/` are recognised. 1231Again, consult your compiler documentation. 1232 1233If the option contains arguments separated by spaces, then the URL-style 1234notation `%20` can be used for the space character in order to avoid having 1235to quote the option. For example, `-opt%20arg` gets expanded to `-opt arg`. 1236In fact, any ASCII character can be encoded as %xx using its hexadecimal 1237encoding. 1238 1239Take note of the [Environment Variables](#environment-variables) documentation 1240below and how these flags interact with those variables. 1241 1242### Environment Variables 1243 1244 VAR=value 1245 1246Assign the given value to the environment variable `VAR` for `Configure`. 1247 1248These work just like normal environment variable assignments, but are supported 1249on all platforms and are confined to the configuration scripts only. 1250These assignments override the corresponding value in the inherited environment, 1251if there is one. 1252 1253The following variables are used as "`make` variables" and can be used as an 1254alternative to giving preprocessor, compiler and linker options directly as 1255configuration. The following variables are supported: 1256 1257 AR The static library archiver. 1258 ARFLAGS Flags for the static library archiver. 1259 AS The assembler compiler. 1260 ASFLAGS Flags for the assembler compiler. 1261 CC The C compiler. 1262 CFLAGS Flags for the C compiler. 1263 CXX The C++ compiler. 1264 CXXFLAGS Flags for the C++ compiler. 1265 CPP The C/C++ preprocessor. 1266 CPPFLAGS Flags for the C/C++ preprocessor. 1267 CPPDEFINES List of CPP macro definitions, separated 1268 by a platform specific character (':' or 1269 space for Unix, ';' for Windows, ',' for 1270 VMS). This can be used instead of using 1271 -D (or what corresponds to that on your 1272 compiler) in CPPFLAGS. 1273 CPPINCLUDES List of CPP inclusion directories, separated 1274 the same way as for CPPDEFINES. This can 1275 be used instead of -I (or what corresponds 1276 to that on your compiler) in CPPFLAGS. 1277 HASHBANGPERL Perl invocation to be inserted after '#!' 1278 in public perl scripts (only relevant on 1279 Unix). 1280 LD The program linker (not used on Unix, $(CC) 1281 is used there). 1282 LDFLAGS Flags for the shared library, DSO and 1283 program linker. 1284 LDLIBS Extra libraries to use when linking. 1285 Takes the form of a space separated list 1286 of library specifications on Unix and 1287 Windows, and as a comma separated list of 1288 libraries on VMS. 1289 RANLIB The library archive indexer. 1290 RC The Windows resource compiler. 1291 RCFLAGS Flags for the Windows resource compiler. 1292 RM The command to remove files and directories. 1293 1294These cannot be mixed with compiling/linking flags given on the command line. 1295In other words, something like this isn't permitted. 1296 1297 $ ./Configure -DFOO CPPFLAGS=-DBAR -DCOOKIE 1298 1299Backward compatibility note: 1300 1301To be compatible with older configuration scripts, the environment variables 1302are ignored if compiling/linking flags are given on the command line, except 1303for the following: 1304 1305 AR, CC, CXX, CROSS_COMPILE, HASHBANGPERL, PERL, RANLIB, RC, and WINDRES 1306 1307For example, the following command will not see `-DBAR`: 1308 1309 $ CPPFLAGS=-DBAR ./Configure -DCOOKIE 1310 1311However, the following will see both set variables: 1312 1313 $ CC=gcc CROSS_COMPILE=x86_64-w64-mingw32- ./Configure -DCOOKIE 1314 1315If `CC` is set, it is advisable to also set `CXX` to ensure both the C and C++ 1316compiler are in the same "family". This becomes relevant with 1317`enable-external-tests` and `enable-buildtest-c++`. 1318 1319### Reconfigure 1320 1321 reconf 1322 reconfigure 1323 1324Reconfigure from earlier data. 1325 1326This fetches the previous command line options and environment from data 1327saved in `configdata.pm` and runs the configuration process again, using 1328these options and environment. Note: NO other option is permitted together 1329with `reconf`. Note: The original configuration saves away values for ALL 1330environment variables that were used, and if they weren't defined, they are 1331still saved away with information that they weren't originally defined. 1332This information takes precedence over environment variables that are 1333defined when reconfiguring. 1334 1335Displaying configuration data 1336----------------------------- 1337 1338The configuration script itself will say very little, and finishes by 1339creating `configdata.pm`. This perl module can be loaded by other scripts 1340to find all the configuration data, and it can also be used as a script to 1341display all sorts of configuration data in a human readable form. 1342 1343For more information, please do: 1344 1345 $ ./configdata.pm --help # Unix 1346 1347or 1348 1349 $ perl configdata.pm --help # Windows and VMS 1350 1351Installation Steps in Detail 1352============================ 1353 1354Configure OpenSSL 1355----------------- 1356 1357### Automatic Configuration 1358 1359In previous version, the `config` script determined the platform type and 1360compiler and then called `Configure`. Starting with version 3.0, they are 1361the same. 1362 1363#### Unix / Linux / macOS 1364 1365 $ ./Configure [options...] 1366 1367#### OpenVMS 1368 1369 $ perl Configure [options...] 1370 1371#### Windows 1372 1373 $ perl Configure [options...] 1374 1375### Manual Configuration 1376 1377OpenSSL knows about a range of different operating system, hardware and 1378compiler combinations. To see the ones it knows about, run 1379 1380 $ ./Configure LIST # Unix 1381 1382or 1383 1384 $ perl Configure LIST # All other platforms 1385 1386For the remainder of this text, the Unix form will be used in all examples. 1387Please use the appropriate form for your platform. 1388 1389Pick a suitable name from the list that matches your system. For most 1390operating systems there is a choice between using cc or gcc. 1391When you have identified your system (and if necessary compiler) use this 1392name as the argument to `Configure`. For example, a `linux-elf` user would 1393run: 1394 1395 $ ./Configure linux-elf [options...] 1396 1397### Creating your own Configuration 1398 1399If your system isn't listed, you will have to create a configuration 1400file named `Configurations/YOURFILENAME.conf` (replace `YOURFILENAME` 1401with a filename of your choosing) and add the correct 1402configuration for your system. See the available configs as examples 1403and read [Configurations/README.md](Configurations/README.md) and 1404[Configurations/README-design.md](Configurations/README-design.md) 1405for more information. 1406 1407The generic configurations `cc` or `gcc` should usually work on 32 bit 1408Unix-like systems. 1409 1410`Configure` creates a build file (`Makefile` on Unix, `makefile` on Windows 1411and `descrip.mms` on OpenVMS) from a suitable template in `Configurations/`, 1412and defines various macros in `include/openssl/configuration.h` (generated 1413from `include/openssl/configuration.h.in`. 1414 1415If none of the generated build files suit your purpose, it's possible to 1416write your own build file template and give its name through the environment 1417variable `BUILDFILE`. For example, Ninja build files could be supported by 1418writing `Configurations/build.ninja.tmpl` and then configure with `BUILDFILE` 1419set like this (Unix syntax shown, you'll have to adapt for other platforms): 1420 1421 $ BUILDFILE=build.ninja perl Configure [options...] 1422 1423### Out of Tree Builds 1424 1425OpenSSL can be configured to build in a build directory separate from the 1426source code directory. It's done by placing yourself in some other 1427directory and invoking the configuration commands from there. 1428 1429#### Unix example 1430 1431 $ mkdir /var/tmp/openssl-build 1432 $ cd /var/tmp/openssl-build 1433 $ /PATH/TO/OPENSSL/SOURCE/Configure [options...] 1434 1435#### OpenVMS example 1436 1437 $ set default sys$login: 1438 $ create/dir [.tmp.openssl-build] 1439 $ set default [.tmp.openssl-build] 1440 $ perl D:[PATH.TO.OPENSSL.SOURCE]Configure [options...] 1441 1442#### Windows example 1443 1444 $ C: 1445 $ mkdir \temp-openssl 1446 $ cd \temp-openssl 1447 $ perl d:\PATH\TO\OPENSSL\SOURCE\Configure [options...] 1448 1449Paths can be relative just as well as absolute. `Configure` will do its best 1450to translate them to relative paths whenever possible. 1451 1452Build OpenSSL 1453------------- 1454 1455Build OpenSSL by running: 1456 1457 $ make # Unix 1458 $ mms ! (or mmk) OpenVMS 1459 $ nmake # Windows 1460 1461This will build the OpenSSL libraries (`libcrypto.a` and `libssl.a` on 1462Unix, corresponding on other platforms) and the OpenSSL binary 1463(`openssl`). The libraries will be built in the top-level directory, 1464and the binary will be in the `apps/` subdirectory. 1465 1466If the build fails, take a look at the [Build Failures](#build-failures) 1467subsection of the [Troubleshooting](#troubleshooting) section. 1468 1469Test OpenSSL 1470------------ 1471 1472After a successful build, and before installing, the libraries should 1473be tested. Run: 1474 1475 $ make test # Unix 1476 $ mms test ! OpenVMS 1477 $ nmake test # Windows 1478 1479**Warning:** you MUST run the tests from an unprivileged account (or disable 1480your privileges temporarily if your platform allows it). 1481 1482See [test/README.md](test/README.md) for further details how run tests. 1483 1484See [test/README-dev.md](test/README-dev.md) for guidelines on adding tests. 1485 1486Install OpenSSL 1487--------------- 1488 1489If everything tests ok, install OpenSSL with 1490 1491 $ make install # Unix 1492 $ mms install ! OpenVMS 1493 $ nmake install # Windows 1494 1495Note that in order to perform the install step above you need to have 1496appropriate permissions to write to the installation directory. 1497 1498The above commands will install all the software components in this 1499directory tree under `<PREFIX>` (the directory given with `--prefix` or 1500its default): 1501 1502### Unix / Linux / macOS 1503 1504 bin/ Contains the openssl binary and a few other 1505 utility scripts. 1506 include/openssl 1507 Contains the header files needed if you want 1508 to build your own programs that use libcrypto 1509 or libssl. 1510 lib Contains the OpenSSL library files. 1511 lib/engines Contains the OpenSSL dynamically loadable engines. 1512 1513 share/man/man1 Contains the OpenSSL command line man-pages. 1514 share/man/man3 Contains the OpenSSL library calls man-pages. 1515 share/man/man5 Contains the OpenSSL configuration format man-pages. 1516 share/man/man7 Contains the OpenSSL other misc man-pages. 1517 1518 share/doc/openssl/html/man1 1519 share/doc/openssl/html/man3 1520 share/doc/openssl/html/man5 1521 share/doc/openssl/html/man7 1522 Contains the HTML rendition of the man-pages. 1523 1524### OpenVMS 1525 1526'arch' is replaced with the architecture name, `ALPHA` or `IA64`, 1527'sover' is replaced with the shared library version (`0101` for 1.1), and 1528'pz' is replaced with the pointer size OpenSSL was built with: 1529 1530 [.EXE.'arch'] Contains the openssl binary. 1531 [.EXE] Contains a few utility scripts. 1532 [.include.openssl] 1533 Contains the header files needed if you want 1534 to build your own programs that use libcrypto 1535 or libssl. 1536 [.LIB.'arch'] Contains the OpenSSL library files. 1537 [.ENGINES'sover''pz'.'arch'] 1538 Contains the OpenSSL dynamically loadable engines. 1539 [.SYS$STARTUP] Contains startup, login and shutdown scripts. 1540 These define appropriate logical names and 1541 command symbols. 1542 [.SYSTEST] Contains the installation verification procedure. 1543 [.HTML] Contains the HTML rendition of the manual pages. 1544 1545### Additional Directories 1546 1547Additionally, install will add the following directories under 1548OPENSSLDIR (the directory given with `--openssldir` or its default) 1549for you convenience: 1550 1551 certs Initially empty, this is the default location 1552 for certificate files. 1553 private Initially empty, this is the default location 1554 for private key files. 1555 misc Various scripts. 1556 1557The installation directory should be appropriately protected to ensure 1558unprivileged users cannot make changes to OpenSSL binaries or files, or 1559install engines. If you already have a pre-installed version of OpenSSL as 1560part of your Operating System it is recommended that you do not overwrite 1561the system version and instead install to somewhere else. 1562 1563Package builders who want to configure the library for standard locations, 1564but have the package installed somewhere else so that it can easily be 1565packaged, can use 1566 1567 $ make DESTDIR=/tmp/package-root install # Unix 1568 $ mms/macro="DESTDIR=TMP:[PACKAGE-ROOT]" install ! OpenVMS 1569 1570The specified destination directory will be prepended to all installation 1571target paths. 1572 1573Compatibility issues with previous OpenSSL versions 1574--------------------------------------------------- 1575 1576### COMPILING existing applications 1577 1578Starting with version 1.1.0, OpenSSL hides a number of structures that were 1579previously open. This includes all internal libssl structures and a number 1580of EVP types. Accessor functions have been added to allow controlled access 1581to the structures' data. 1582 1583This means that some software needs to be rewritten to adapt to the new ways 1584of doing things. This often amounts to allocating an instance of a structure 1585explicitly where you could previously allocate them on the stack as automatic 1586variables, and using the provided accessor functions where you would previously 1587access a structure's field directly. 1588 1589Some APIs have changed as well. However, older APIs have been preserved when 1590possible. 1591 1592Post-installation Notes 1593----------------------- 1594 1595With the default OpenSSL installation comes a FIPS provider module, which 1596needs some post-installation attention, without which it will not be usable. 1597This involves using the following command: 1598 1599 $ openssl fipsinstall 1600 1601See the openssl-fipsinstall(1) manual for details and examples. 1602 1603Advanced Build Options 1604====================== 1605 1606Environment Variables 1607--------------------- 1608 1609A number of environment variables can be used to provide additional control 1610over the build process. Typically these should be defined prior to running 1611`Configure`. Not all environment variables are relevant to all platforms. 1612 1613 AR 1614 The name of the ar executable to use. 1615 1616 BUILDFILE 1617 Use a different build file name than the platform default 1618 ("Makefile" on Unix-like platforms, "makefile" on native Windows, 1619 "descrip.mms" on OpenVMS). This requires that there is a 1620 corresponding build file template. 1621 See [Configurations/README.md](Configurations/README.md) 1622 for further information. 1623 1624 CC 1625 The compiler to use. Configure will attempt to pick a default 1626 compiler for your platform but this choice can be overridden 1627 using this variable. Set it to the compiler executable you wish 1628 to use, e.g. gcc or clang. 1629 1630 CROSS_COMPILE 1631 This environment variable has the same meaning as for the 1632 "--cross-compile-prefix" Configure flag described above. If both 1633 are set then the Configure flag takes precedence. 1634 1635 HASHBANGPERL 1636 The command string for the Perl executable to insert in the 1637 #! line of perl scripts that will be publicly installed. 1638 Default: /usr/bin/env perl 1639 Note: the value of this variable is added to the same scripts 1640 on all platforms, but it's only relevant on Unix-like platforms. 1641 1642 KERNEL_BITS 1643 This can be the value `32` or `64` to specify the architecture 1644 when it is not "obvious" to the configuration. It should generally 1645 not be necessary to specify this environment variable. 1646 1647 NM 1648 The name of the nm executable to use. 1649 1650 OPENSSL_LOCAL_CONFIG_DIR 1651 OpenSSL comes with a database of information about how it 1652 should be built on different platforms as well as build file 1653 templates for those platforms. The database is comprised of 1654 ".conf" files in the Configurations directory. The build 1655 file templates reside there as well as ".tmpl" files. See the 1656 file [Configurations/README.md](Configurations/README.md) 1657 for further information about the format of ".conf" files 1658 as well as information on the ".tmpl" files. 1659 In addition to the standard ".conf" and ".tmpl" files, it is 1660 possible to create your own ".conf" and ".tmpl" files and 1661 store them locally, outside the OpenSSL source tree. 1662 This environment variable can be set to the directory where 1663 these files are held and will be considered by Configure 1664 before it looks in the standard directories. 1665 1666 PERL 1667 The name of the Perl executable to use when building OpenSSL. 1668 Only needed if building should use a different Perl executable 1669 than what is used to run the Configure script. 1670 1671 RANLIB 1672 The name of the ranlib executable to use. 1673 1674 RC 1675 The name of the rc executable to use. The default will be as 1676 defined for the target platform in the ".conf" file. If not 1677 defined then "windres" will be used. The WINDRES environment 1678 variable is synonymous to this. If both are defined then RC 1679 takes precedence. 1680 1681 WINDRES 1682 See RC. 1683 1684Makefile Targets 1685---------------- 1686 1687The `Configure` script generates a Makefile in a format relevant to the specific 1688platform. The Makefiles provide a number of targets that can be used. Not all 1689targets may be available on all platforms. Only the most common targets are 1690described here. Examine the Makefiles themselves for the full list. 1691 1692 all 1693 The target to build all the software components and 1694 documentation. 1695 1696 build_sw 1697 Build all the software components. 1698 THIS IS THE DEFAULT TARGET. 1699 1700 build_docs 1701 Build all documentation components. 1702 1703 debuginfo 1704 On unix platforms, this target can be used to create .debug 1705 libraries, which separate the DWARF information in the 1706 shared library ELF files into a separate file for use 1707 in post-mortem (core dump) debugging 1708 1709 clean 1710 Remove all build artefacts and return the directory to a "clean" 1711 state. 1712 1713 depend 1714 Rebuild the dependencies in the Makefiles. This is a legacy 1715 option that no longer needs to be used since OpenSSL 1.1.0. 1716 1717 install 1718 Install all OpenSSL components. 1719 1720 install_sw 1721 Only install the OpenSSL software components. 1722 1723 install_docs 1724 Only install the OpenSSL documentation components. 1725 1726 install_man_docs 1727 Only install the OpenSSL man pages (Unix only). 1728 1729 install_html_docs 1730 Only install the OpenSSL HTML documentation. 1731 1732 install_fips 1733 Install the FIPS provider module configuration file. 1734 1735 list-tests 1736 Prints a list of all the self test names. 1737 1738 test 1739 Build and run the OpenSSL self tests. 1740 1741 uninstall 1742 Uninstall all OpenSSL components. 1743 1744 reconfigure 1745 reconf 1746 Re-run the configuration process, as exactly as the last time 1747 as possible. 1748 1749 update 1750 This is a developer option. If you are developing a patch for 1751 OpenSSL you may need to use this if you want to update 1752 automatically generated files; add new error codes or add new 1753 (or change the visibility of) public API functions. (Unix only). 1754 1755Running Selected Tests 1756---------------------- 1757 1758You can specify a set of tests to be performed 1759using the `make` variable `TESTS`. 1760 1761See the section [Running Selected Tests of 1762test/README.md](test/README.md#running-selected-tests). 1763 1764Troubleshooting 1765=============== 1766 1767Configuration Problems 1768---------------------- 1769 1770### Selecting the correct target 1771 1772The `./Configure` script tries hard to guess your operating system, but in some 1773cases it does not succeed. You will see a message like the following: 1774 1775 $ ./Configure 1776 Operating system: x86-whatever-minix 1777 This system (minix) is not supported. See file INSTALL.md for details. 1778 1779Even if the automatic target selection by the `./Configure` script fails, 1780chances are that you still might find a suitable target in the `Configurations` 1781directory, which you can supply to the `./Configure` command, 1782possibly after some adjustment. 1783 1784The `Configurations/` directory contains a lot of examples of such targets. 1785The main configuration file is [10-main.conf], which contains all targets that 1786are officially supported by the OpenSSL team. Other configuration files contain 1787targets contributed by other OpenSSL users. The list of targets can be found in 1788a Perl list `my %targets = ( ... )`. 1789 1790 my %targets = ( 1791 ... 1792 "target-name" => { 1793 inherit_from => [ "base-target" ], 1794 CC => "...", 1795 cflags => add("..."), 1796 asm_arch => '...', 1797 perlasm_scheme => "...", 1798 }, 1799 ... 1800 ) 1801 1802If you call `./Configure` without arguments, it will give you a list of all 1803known targets. Using `grep`, you can lookup the target definition in the 1804`Configurations/` directory. For example the `android-x86_64` can be found in 1805[Configurations/15-android.conf](Configurations/15-android.conf). 1806 1807The directory contains two README files, which explain the general syntax and 1808design of the configuration files. 1809 1810 - [Configurations/README.md](Configurations/README.md) 1811 - [Configurations/README-design.md](Configurations/README-design.md) 1812 1813If you need further help, try to search the [openssl-users] mailing list 1814or the [GitHub Issues] for existing solutions. If you don't find anything, 1815you can [raise an issue] to ask a question yourself. 1816 1817More about our support resources can be found in the [SUPPORT] file. 1818 1819### Configuration Errors 1820 1821If the `./config` or `./Configure` command fails with an error message, 1822read the error message carefully and try to figure out whether you made 1823a mistake (e.g., by providing a wrong option), or whether the script is 1824working incorrectly. If you think you encountered a bug, please 1825[raise an issue] on GitHub to file a bug report. 1826 1827Along with a short description of the bug, please provide the complete 1828configure command line and the relevant output including the error message. 1829 1830Note: To make the output readable, please add a 'code fence' (three backquotes 1831` ``` ` on a separate line) before and after your output: 1832 1833 ``` 1834 ./Configure [your arguments...] 1835 1836 [output...] 1837 1838 ``` 1839 1840Build Failures 1841-------------- 1842 1843If the build fails, look carefully at the output. Try to locate and understand 1844the error message. It might be that the compiler is already telling you 1845exactly what you need to do to fix your problem. 1846 1847There may be reasons for the failure that aren't problems in OpenSSL itself, 1848for example if the compiler reports missing standard or third party headers. 1849 1850If the build succeeded previously, but fails after a source or configuration 1851change, it might be helpful to clean the build tree before attempting another 1852build. Use this command: 1853 1854 $ make clean # Unix 1855 $ mms clean ! (or mmk) OpenVMS 1856 $ nmake clean # Windows 1857 1858Assembler error messages can sometimes be sidestepped by using the `no-asm` 1859configuration option. See also [notes](#notes-on-assembler-modules-compilation). 1860 1861Compiling parts of OpenSSL with gcc and others with the system compiler will 1862result in unresolved symbols on some systems. 1863 1864If you are still having problems, try to search the [openssl-users] mailing 1865list or the [GitHub Issues] for existing solutions. If you think you 1866encountered an OpenSSL bug, please [raise an issue] to file a bug report. 1867Please take the time to review the existing issues first; maybe the bug was 1868already reported or has already been fixed. 1869 1870Test Failures 1871------------- 1872 1873If some tests fail, look at the output. There may be reasons for the failure 1874that isn't a problem in OpenSSL itself (like an OS malfunction or a Perl issue). 1875 1876You may want increased verbosity, that can be accomplished as described in 1877section [Test Failures of test/README.md](test/README.md#test-failures). 1878 1879You may also want to selectively specify which test(s) to perform. This can be 1880done using the `make` variable `TESTS` as described in section [Running 1881Selected Tests of test/README.md](test/README.md#running-selected-tests). 1882 1883If you find a problem with OpenSSL itself, try removing any 1884compiler optimization flags from the `CFLAGS` line in the Makefile and 1885run `make clean; make` or corresponding. 1886 1887To report a bug please open an issue on GitHub, at 1888<https://github.com/openssl/openssl/issues>. 1889 1890Notes 1891===== 1892 1893Notes on multi-threading 1894------------------------ 1895 1896For some systems, the OpenSSL `Configure` script knows what compiler options 1897are needed to generate a library that is suitable for multi-threaded 1898applications. On these systems, support for multi-threading is enabled 1899by default; use the `no-threads` option to disable (this should never be 1900necessary). 1901 1902On other systems, to enable support for multi-threading, you will have 1903to specify at least two options: `threads`, and a system-dependent option. 1904(The latter is `-D_REENTRANT` on various systems.) The default in this 1905case, obviously, is not to include support for multi-threading (but 1906you can still use `no-threads` to suppress an annoying warning message 1907from the `Configure` script.) 1908 1909OpenSSL provides built-in support for two threading models: pthreads (found on 1910most UNIX/Linux systems), and Windows threads. No other threading models are 1911supported. If your platform does not provide pthreads or Windows threads then 1912you should use `Configure` with the `no-threads` option. 1913 1914For pthreads, all locks are non-recursive. In addition, in a debug build, 1915the mutex attribute `PTHREAD_MUTEX_ERRORCHECK` is used. If this is not 1916available on your platform, you might have to add 1917`-DOPENSSL_NO_MUTEX_ERRORCHECK` to your `Configure` invocation. 1918(On Linux `PTHREAD_MUTEX_ERRORCHECK` is an enum value, so a built-in 1919ifdef test cannot be used.) 1920 1921Notes on shared libraries 1922------------------------- 1923 1924For most systems the OpenSSL `Configure` script knows what is needed to 1925build shared libraries for libcrypto and libssl. On these systems 1926the shared libraries will be created by default. This can be suppressed and 1927only static libraries created by using the `no-shared` option. On systems 1928where OpenSSL does not know how to build shared libraries the `no-shared` 1929option will be forced and only static libraries will be created. 1930 1931Shared libraries are named a little differently on different platforms. 1932One way or another, they all have the major OpenSSL version number as 1933part of the file name, i.e. for OpenSSL 1.1.x, `1.1` is somehow part of 1934the name. 1935 1936On most POSIX platforms, shared libraries are named `libcrypto.so.1.1` 1937and `libssl.so.1.1`. 1938 1939on Cygwin, shared libraries are named `cygcrypto-1.1.dll` and `cygssl-1.1.dll` 1940with import libraries `libcrypto.dll.a` and `libssl.dll.a`. 1941 1942On Windows build with MSVC or using MingW, shared libraries are named 1943`libcrypto-1_1.dll` and `libssl-1_1.dll` for 32-bit Windows, 1944`libcrypto-1_1-x64.dll` and `libssl-1_1-x64.dll` for 64-bit x86_64 Windows, 1945and `libcrypto-1_1-ia64.dll` and `libssl-1_1-ia64.dll` for IA64 Windows. 1946With MSVC, the import libraries are named `libcrypto.lib` and `libssl.lib`, 1947while with MingW, they are named `libcrypto.dll.a` and `libssl.dll.a`. 1948 1949On VMS, shareable images (VMS speak for shared libraries) are named 1950`ossl$libcrypto0101_shr.exe` and `ossl$libssl0101_shr.exe`. However, when 1951OpenSSL is specifically built for 32-bit pointers, the shareable images 1952are named `ossl$libcrypto0101_shr32.exe` and `ossl$libssl0101_shr32.exe` 1953instead, and when built for 64-bit pointers, they are named 1954`ossl$libcrypto0101_shr64.exe` and `ossl$libssl0101_shr64.exe`. 1955 1956Notes on random number generation 1957--------------------------------- 1958 1959Availability of cryptographically secure random numbers is required for 1960secret key generation. OpenSSL provides several options to seed the 1961internal CSPRNG. If not properly seeded, the internal CSPRNG will refuse 1962to deliver random bytes and a "PRNG not seeded error" will occur. 1963 1964The seeding method can be configured using the `--with-rand-seed` option, 1965which can be used to specify a comma separated list of seed methods. 1966However, in most cases OpenSSL will choose a suitable default method, 1967so it is not necessary to explicitly provide this option. Note also 1968that not all methods are available on all platforms. The FIPS provider will 1969silently ignore seed sources that were not validated. 1970 1971I) On operating systems which provide a suitable randomness source (in 1972form of a system call or system device), OpenSSL will use the optimal 1973available method to seed the CSPRNG from the operating system's 1974randomness sources. This corresponds to the option `--with-rand-seed=os`. 1975 1976II) On systems without such a suitable randomness source, automatic seeding 1977and reseeding is disabled (`--with-rand-seed=none`) and it may be necessary 1978to install additional support software to obtain a random seed and reseed 1979the CSPRNG manually. Please check out the manual pages for `RAND_add()`, 1980`RAND_bytes()`, `RAND_egd()`, and the FAQ for more information. 1981 1982Notes on assembler modules compilation 1983-------------------------------------- 1984 1985Compilation of some code paths in assembler modules might depend on whether the 1986current assembler version supports certain ISA extensions or not. Code paths 1987that use the AES-NI, PCLMULQDQ, SSSE3, and SHA extensions are always assembled. 1988Apart from that, the minimum requirements for the assembler versions are shown 1989in the table below: 1990 1991| ISA extension | GNU as | nasm | llvm | 1992|---------------|--------|--------|---------| 1993| AVX | 2.19 | 2.09 | 3.0 | 1994| AVX2 | 2.22 | 2.10 | 3.1 | 1995| ADCX/ADOX | 2.23 | 2.10 | 3.3 | 1996| AVX512 | 2.25 | 2.11.8 | 3.6 (*) | 1997| AVX512IFMA | 2.26 | 2.11.8 | 6.0 (*) | 1998| VAES | 2.30 | 2.13.3 | 6.0 (*) | 1999 2000--- 2001 2002(*) Even though AVX512 support was implemented in llvm 3.6, prior to version 7.0 2003an explicit -march flag was apparently required to compile assembly modules. But 2004then the compiler generates processor-specific code, which in turn contradicts 2005the idea of performing dispatch at run-time, which is facilitated by the special 2006variable `OPENSSL_ia32cap`. For versions older than 7.0, it is possible to work 2007around the problem by forcing the build procedure to use the following script: 2008 2009 #!/bin/sh 2010 exec clang -no-integrated-as "$@" 2011 2012instead of the real clang. In which case it doesn't matter what clang version 2013is used, as it is the version of the GNU assembler that will be checked. 2014 2015--- 2016 2017<!-- Links --> 2018 2019[openssl-users]: 2020 <https://mta.openssl.org/mailman/listinfo/openssl-users> 2021 2022[SUPPORT]: 2023 ./SUPPORT.md 2024 2025[GitHub Issues]: 2026 <https://github.com/openssl/openssl/issues> 2027 2028[raise an issue]: 2029 <https://github.com/openssl/openssl/issues/new/choose> 2030 2031[10-main.conf]: 2032 Configurations/10-main.conf 2033 2034[CMVP]: 2035 <https://csrc.nist.gov/projects/cryptographic-module-validation-program> 2036 2037[ESV]: 2038 <https://csrc.nist.gov/Projects/cryptographic-module-validation-program/entropy-validations> 2039 2040[SP 800-90B]: 2041 <https://csrc.nist.gov/pubs/sp/800/90/b/final> 2042 2043[jitterentropy-library]: 2044 <https://github.com/smuellerDD/jitterentropy-library> 2045
