1Build and Install 2================= 3 4This document describes installation on all supported operating 5systems (the Unix/Linux family, including macOS), OpenVMS, 6and Windows). 7 8Table of Contents 9================= 10 11 - [Prerequisites](#prerequisites) 12 - [Notational Conventions](#notational-conventions) 13 - [Quick Installation Guide](#quick-installation-guide) 14 - [Building OpenSSL](#building-openssl) 15 - [Installing OpenSSL](#installing-openssl) 16 - [Configuration Options](#configuration-options) 17 - [API Level](#api-level) 18 - [Cross Compile Prefix](#cross-compile-prefix) 19 - [Build Type](#build-type) 20 - [Directories](#directories) 21 - [Compiler Warnings](#compiler-warnings) 22 - [ZLib Flags](#zlib-flags) 23 - [Seeding the Random Generator](#seeding-the-random-generator) 24 - [Setting the FIPS HMAC key](#setting-the-FIPS-HMAC-key) 25 - [Enable and Disable Features](#enable-and-disable-features) 26 - [Displaying configuration data](#displaying-configuration-data) 27 - [Installation Steps in Detail](#installation-steps-in-detail) 28 - [Configure](#configure-openssl) 29 - [Build](#build-openssl) 30 - [Test](#test-openssl) 31 - [Install](#install-openssl) 32 - [Advanced Build Options](#advanced-build-options) 33 - [Environment Variables](#environment-variables) 34 - [Makefile Targets](#makefile-targets) 35 - [Running Selected Tests](#running-selected-tests) 36 - [Troubleshooting](#troubleshooting) 37 - [Configuration Problems](#configuration-problems) 38 - [Build Failures](#build-failures) 39 - [Test Failures](#test-failures) 40 - [Notes](#notes) 41 - [Notes on multi-threading](#notes-on-multi-threading) 42 - [Notes on shared libraries](#notes-on-shared-libraries) 43 - [Notes on random number generation](#notes-on-random-number-generation) 44 - [Notes on assembler modules compilation](#notes-on-assembler-modules-compilation) 45 46Prerequisites 47============= 48 49To install OpenSSL, you will need: 50 51 * A "make" implementation 52 * Perl 5 with core modules (please read [NOTES-PERL.md](NOTES-PERL.md)) 53 * The Perl module `Text::Template` (please read [NOTES-PERL.md](NOTES-PERL.md)) 54 * an ANSI C compiler 55 * a development environment in the form of development libraries and C 56 header files 57 * a supported operating system 58 59For additional platform specific requirements, solutions to specific 60issues and other details, please read one of these: 61 62 * [Notes for UNIX-like platforms](NOTES-UNIX.md) 63 * [Notes for Android platforms](NOTES-ANDROID.md) 64 * [Notes for Windows platforms](NOTES-WINDOWS.md) 65 * [Notes for the DOS platform with DJGPP](NOTES-DJGPP.md) 66 * [Notes for the OpenVMS platform](NOTES-VMS.md) 67 * [Notes on Perl](NOTES-PERL.md) 68 * [Notes on Valgrind](NOTES-VALGRIND.md) 69 70Notational conventions 71====================== 72 73Throughout this document, we use the following conventions. 74 75Commands 76-------- 77 78Any line starting with a dollar sign is a command line. 79 80 $ command 81 82The dollar sign indicates the shell prompt and is not to be entered as 83part of the command. 84 85Choices 86------- 87 88Several words in curly braces separated by pipe characters indicate a 89**mandatory choice**, to be replaced with one of the given words. 90For example, the line 91 92 $ echo { WORD1 | WORD2 | WORD3 } 93 94represents one of the following three commands 95 96 $ echo WORD1 97 - or - 98 $ echo WORD2 99 - or - 100 $ echo WORD3 101 102One or several words in square brackets separated by pipe characters 103denote an **optional choice**. It is similar to the mandatory choice, 104but it can also be omitted entirely. 105 106So the line 107 108 $ echo [ WORD1 | WORD2 | WORD3 ] 109 110represents one of the four commands 111 112 $ echo WORD1 113 - or - 114 $ echo WORD2 115 - or - 116 $ echo WORD3 117 - or - 118 $ echo 119 120Arguments 121--------- 122 123**Optional Arguments** are enclosed in square brackets. 124 125 [option...] 126 127A trailing ellipsis means that more than one could be specified. 128 129Quick Installation Guide 130======================== 131 132If you just want to get OpenSSL installed without bothering too much 133about the details, here is the short version of how to build and install 134OpenSSL. If any of the following steps fails, please consult the 135[Installation in Detail](#installation-steps-in-detail) section below. 136 137Building OpenSSL 138---------------- 139 140Use the following commands to configure, build and test OpenSSL. 141The testing is optional, but recommended if you intend to install 142OpenSSL for production use. 143 144### Unix / Linux / macOS 145 146 $ ./Configure 147 $ make 148 $ make test 149 150### OpenVMS 151 152Use the following commands to build OpenSSL: 153 154 $ perl Configure 155 $ mms 156 $ mms test 157 158### Windows 159 160If you are using Visual Studio, open a Developer Command Prompt and 161issue the following commands to build OpenSSL. 162 163 $ perl Configure 164 $ nmake 165 $ nmake test 166 167As mentioned in the [Choices](#choices) section, you need to pick one 168of the four Configure targets in the first command. 169 170Most likely you will be using the `VC-WIN64A` target for 64bit Windows 171binaries (AMD64) or `VC-WIN32` for 32bit Windows binaries (X86). 172The other two options are `VC-WIN64I` (Intel IA64, Itanium) and 173`VC-CE` (Windows CE) are rather uncommon nowadays. 174 175Installing OpenSSL 176------------------ 177 178The following commands will install OpenSSL to a default system location. 179 180**Danger Zone:** even if you are impatient, please read the following two 181paragraphs carefully before you install OpenSSL. 182 183For security reasons the default system location is by default not writable 184for unprivileged users. So for the final installation step administrative 185privileges are required. The default system location and the procedure to 186obtain administrative privileges depends on the operating system. 187It is recommended to compile and test OpenSSL with normal user privileges 188and use administrative privileges only for the final installation step. 189 190On some platforms OpenSSL is preinstalled as part of the Operating System. 191In this case it is highly recommended not to overwrite the system versions, 192because other applications or libraries might depend on it. 193To avoid breaking other applications, install your copy of OpenSSL to a 194[different location](#installing-to-a-different-location) which is not in 195the global search path for system libraries. 196 197Finally, if you plan on using the FIPS module, you need to read the 198[Post-installation Notes](#post-installation-notes) further down. 199 200### Unix / Linux / macOS 201 202Depending on your distribution, you need to run the following command as 203root user or prepend `sudo` to the command: 204 205 $ make install 206 207By default, OpenSSL will be installed to 208 209 /usr/local 210 211More precisely, the files will be installed into the subdirectories 212 213 /usr/local/bin 214 /usr/local/lib 215 /usr/local/include 216 ... 217 218depending on the file type, as it is custom on Unix-like operating systems. 219 220### OpenVMS 221 222Use the following command to install OpenSSL. 223 224 $ mms install 225 226By default, OpenSSL will be installed to 227 228 SYS$COMMON:[OPENSSL] 229 230### Windows 231 232If you are using Visual Studio, open the Developer Command Prompt _elevated_ 233and issue the following command. 234 235 $ nmake install 236 237The easiest way to elevate the Command Prompt is to press and hold down 238the both the `<CTRL>` and `<SHIFT>` key while clicking the menu item in the 239task menu. 240 241The default installation location is 242 243 C:\Program Files\OpenSSL 244 245for native binaries, or 246 247 C:\Program Files (x86)\OpenSSL 248 249for 32bit binaries on 64bit Windows (WOW64). 250 251#### Installing to a different location 252 253To install OpenSSL to a different location (for example into your home 254directory for testing purposes) run `Configure` as shown in the following 255examples. 256 257The options `--prefix` and `--openssldir` are explained in further detail in 258[Directories](#directories) below, and the values used here are mere examples. 259 260On Unix: 261 262 $ ./Configure --prefix=/opt/openssl --openssldir=/usr/local/ssl 263 264On OpenVMS: 265 266 $ perl Configure --prefix=PROGRAM:[INSTALLS] --openssldir=SYS$MANAGER:[OPENSSL] 267 268Note: if you do add options to the configuration command, please make sure 269you've read more than just this Quick Start, such as relevant `NOTES-*` files, 270the options outline below, as configuration options may change the outcome 271in otherwise unexpected ways. 272 273Configuration Options 274===================== 275 276There are several options to `./Configure` to customize the build (note that 277for Windows, the defaults for `--prefix` and `--openssldir` depend on what 278configuration is used and what Windows implementation OpenSSL is built on. 279For more information, see the [Notes for Windows platforms](NOTES-WINDOWS.md). 280 281API Level 282--------- 283 284 --api=x.y[.z] 285 286Build the OpenSSL libraries to support the API for the specified version. 287If [no-deprecated](#no-deprecated) is also given, don't build with support 288for deprecated APIs in or below the specified version number. For example, 289adding 290 291 --api=1.1.0 no-deprecated 292 293will remove support for all APIs that were deprecated in OpenSSL version 2941.1.0 or below. This is a rather specialized option for developers. 295If you just intend to remove all deprecated APIs up to the current version 296entirely, just specify [no-deprecated](#no-deprecated). 297If `--api` isn't given, it defaults to the current (minor) OpenSSL version. 298 299Cross Compile Prefix 300-------------------- 301 302 --cross-compile-prefix=<PREFIX> 303 304The `<PREFIX>` to include in front of commands for your toolchain. 305 306It is likely to have to end with dash, e.g. `a-b-c-` would invoke GNU compiler 307as `a-b-c-gcc`, etc. Unfortunately cross-compiling is too case-specific to put 308together one-size-fits-all instructions. You might have to pass more flags or 309set up environment variables to actually make it work. Android and iOS cases 310are discussed in corresponding `Configurations/15-*.conf` files. But there are 311cases when this option alone is sufficient. For example to build the mingw64 312target on Linux `--cross-compile-prefix=x86_64-w64-mingw32-` works. Naturally 313provided that mingw packages are installed. Today Debian and Ubuntu users 314have option to install a number of prepackaged cross-compilers along with 315corresponding run-time and development packages for "alien" hardware. To give 316another example `--cross-compile-prefix=mipsel-linux-gnu-` suffices in such 317case. 318 319For cross compilation, you must [configure manually](#manual-configuration). 320Also, note that `--openssldir` refers to target's file system, not one you are 321building on. 322 323Build Type 324---------- 325 326 --debug 327 328Build OpenSSL with debugging symbols and zero optimization level. 329 330 --release 331 332Build OpenSSL without debugging symbols. This is the default. 333 334Directories 335----------- 336 337### libdir 338 339 --libdir=DIR 340 341The name of the directory under the top of the installation directory tree 342(see the `--prefix` option) where libraries will be installed. By default 343this is `lib`. Note that on Windows only static libraries (`*.lib`) will 344be stored in this location. Shared libraries (`*.dll`) will always be 345installed to the `bin` directory. 346 347Some build targets have a multilib postfix set in the build configuration. 348For these targets the default libdir is `lib<multilib-postfix>`. Please use 349`--libdir=lib` to override the libdir if adding the postfix is undesirable. 350 351### openssldir 352 353 --openssldir=DIR 354 355Directory for OpenSSL configuration files, and also the default certificate 356and key store. Defaults are: 357 358 Unix: /usr/local/ssl 359 Windows: C:\Program Files\Common Files\SSL 360 OpenVMS: SYS$COMMON:[OPENSSL-COMMON] 361 362For 32bit Windows applications on Windows 64bit (WOW64), always replace 363`C:\Program Files` by `C:\Program Files (x86)`. 364 365### prefix 366 367 --prefix=DIR 368 369The top of the installation directory tree. Defaults are: 370 371 Unix: /usr/local 372 Windows: C:\Program Files\OpenSSL 373 OpenVMS: SYS$COMMON:[OPENSSL] 374 375Compiler Warnings 376----------------- 377 378 --strict-warnings 379 380This is a developer flag that switches on various compiler options recommended 381for OpenSSL development. It only works when using gcc or clang as the compiler. 382If you are developing a patch for OpenSSL then it is recommended that you use 383this option where possible. 384 385ZLib Flags 386---------- 387 388### with-zlib-include 389 390 --with-zlib-include=DIR 391 392The directory for the location of the zlib include file. This option is only 393necessary if [zlib](#zlib) is used and the include file is not 394already on the system include path. 395 396### with-zlib-lib 397 398 --with-zlib-lib=LIB 399 400**On Unix**: this is the directory containing the zlib library. 401If not provided the system library path will be used. 402 403**On Windows:** this is the filename of the zlib library (with or 404without a path). This flag must be provided if the 405[zlib-dynamic](#zlib-dynamic) option is not also used. If `zlib-dynamic` is used 406then this flag is optional and defaults to `ZLIB1` if not provided. 407 408**On VMS:** this is the filename of the zlib library (with or without a path). 409This flag is optional and if not provided then `GNV$LIBZSHR`, `GNV$LIBZSHR32` 410or `GNV$LIBZSHR64` is used by default depending on the pointer size chosen. 411 412Seeding the Random Generator 413---------------------------- 414 415 --with-rand-seed=seed1[,seed2,...] 416 417A comma separated list of seeding methods which will be tried by OpenSSL 418in order to obtain random input (a.k.a "entropy") for seeding its 419cryptographically secure random number generator (CSPRNG). 420The current seeding methods are: 421 422### os 423 424Use a trusted operating system entropy source. 425This is the default method if such an entropy source exists. 426 427### getrandom 428 429Use the [getrandom(2)][man-getrandom] or equivalent system call. 430 431[man-getrandom]: http://man7.org/linux/man-pages/man2/getrandom.2.html 432 433### devrandom 434 435Use the first device from the `DEVRANDOM` list which can be opened to read 436random bytes. The `DEVRANDOM` preprocessor constant expands to 437 438 "/dev/urandom","/dev/random","/dev/srandom" 439 440on most unix-ish operating systems. 441 442### egd 443 444Check for an entropy generating daemon. 445This source is ignored by the FIPS provider. 446 447### rdcpu 448 449Use the `RDSEED` or `RDRAND` command on x86 or `RNDRRS` command on aarch64 450if provided by the CPU. 451 452### librandom 453 454Use librandom (not implemented yet). 455This source is ignored by the FIPS provider. 456 457### none 458 459Disable automatic seeding. This is the default on some operating systems where 460no suitable entropy source exists, or no support for it is implemented yet. 461This option is ignored by the FIPS provider. 462 463For more information, see the section [Notes on random number generation][rng] 464at the end of this document. 465 466[rng]: #notes-on-random-number-generation 467 468Setting the FIPS HMAC key 469------------------------- 470 471 --fips-key=value 472 473As part of its self-test validation, the FIPS module must verify itself 474by performing a SHA-256 HMAC computation on itself. The default key is 475the SHA256 value of "the holy handgrenade of antioch" and is sufficient 476for meeting the FIPS requirements. 477 478To change the key to a different value, use this flag. The value should 479be a hex string no more than 64 characters. 480 481Enable and Disable Features 482--------------------------- 483 484Feature options always come in pairs, an option to enable feature 485`xxxx`, and an option to disable it: 486 487 [ enable-xxxx | no-xxxx ] 488 489Whether a feature is enabled or disabled by default, depends on the feature. 490In the following list, always the non-default variant is documented: if 491feature `xxxx` is disabled by default then `enable-xxxx` is documented and 492if feature `xxxx` is enabled by default then `no-xxxx` is documented. 493 494### no-afalgeng 495 496Don't build the AFALG engine. 497 498This option will be forced on a platform that does not support AFALG. 499 500### enable-ktls 501 502Build with Kernel TLS support. 503 504This option will enable the use of the Kernel TLS data-path, which can improve 505performance and allow for the use of sendfile and splice system calls on 506TLS sockets. The Kernel may use TLS accelerators if any are available on the 507system. This option will be forced off on systems that do not support the 508Kernel TLS data-path. 509 510### enable-asan 511 512Build with the Address sanitiser. 513 514This is a developer option only. It may not work on all platforms and should 515never be used in production environments. It will only work when used with 516gcc or clang and should be used in conjunction with the [no-shared](#no-shared) 517option. 518 519### enable-acvp-tests 520 521Build support for Automated Cryptographic Validation Protocol (ACVP) 522tests. 523 524This is required for FIPS validation purposes. Certain ACVP tests require 525access to algorithm internals that are not normally accessible. 526Additional information related to ACVP can be found at 527<https://github.com/usnistgov/ACVP>. 528 529### no-asm 530 531Do not use assembler code. 532 533This should be viewed as debugging/troubleshooting option rather than for 534production use. On some platforms a small amount of assembler code may still 535be used even with this option. 536 537### no-async 538 539Do not build support for async operations. 540 541### no-autoalginit 542 543Don't automatically load all supported ciphers and digests. 544 545Typically OpenSSL will make available all of its supported ciphers and digests. 546For a statically linked application this may be undesirable if small executable 547size is an objective. This only affects libcrypto. Ciphers and digests will 548have to be loaded manually using `EVP_add_cipher()` and `EVP_add_digest()` 549if this option is used. This option will force a non-shared build. 550 551### no-autoerrinit 552 553Don't automatically load all libcrypto/libssl error strings. 554 555Typically OpenSSL will automatically load human readable error strings. For a 556statically linked application this may be undesirable if small executable size 557is an objective. 558 559### no-autoload-config 560 561Don't automatically load the default `openssl.cnf` file. 562 563Typically OpenSSL will automatically load a system config file which configures 564default SSL options. 565 566### enable-buildtest-c++ 567 568While testing, generate C++ buildtest files that simply check that the public 569OpenSSL header files are usable standalone with C++. 570 571Enabling this option demands extra care. For any compiler flag given directly 572as configuration option, you must ensure that it's valid for both the C and 573the C++ compiler. If not, the C++ build test will most likely break. As an 574alternative, you can use the language specific variables, `CFLAGS` and `CXXFLAGS`. 575 576### --banner=text 577 578Use the specified text instead of the default banner at the end of 579configuration. 580 581### --w 582 583On platforms where the choice of 32-bit or 64-bit architecture 584is not explicitly specified, `Configure` will print a warning 585message and wait for a few seconds to let you interrupt the 586configuration. Using this flag skips the wait. 587 588### no-bulk 589 590Build only some minimal set of features. 591This is a developer option used internally for CI build tests of the project. 592 593### no-cached-fetch 594 595Never cache algorithms when they are fetched from a provider. Normally, a 596provider indicates if the algorithms it supplies can be cached or not. Using 597this option will reduce run-time memory usage but it also introduces a 598significant performance penalty. This option is primarily designed to help 599with detecting incorrect reference counting. 600 601### no-capieng 602 603Don't build the CAPI engine. 604 605This option will be forced if on a platform that does not support CAPI. 606 607### no-cmp 608 609Don't build support for Certificate Management Protocol (CMP) 610and Certificate Request Message Format (CRMF). 611 612### no-cms 613 614Don't build support for Cryptographic Message Syntax (CMS). 615 616### no-comp 617 618Don't build support for SSL/TLS compression. 619 620If this option is enabled (the default), then compression will only work if 621the zlib or `zlib-dynamic` options are also chosen. 622 623### enable-crypto-mdebug 624 625This now only enables the `failed-malloc` feature. 626 627### enable-crypto-mdebug-backtrace 628 629This is a no-op; the project uses the compiler's address/leak sanitizer instead. 630 631### no-ct 632 633Don't build support for Certificate Transparency (CT). 634 635### no-deprecated 636 637Don't build with support for deprecated APIs up until and including the version 638given with `--api` (or the current version, if `--api` wasn't specified). 639 640### no-dgram 641 642Don't build support for datagram based BIOs. 643 644Selecting this option will also force the disabling of DTLS. 645 646### no-dso 647 648Don't build support for loading Dynamic Shared Objects (DSO) 649 650### enable-devcryptoeng 651 652Build the `/dev/crypto` engine. 653 654This option is automatically selected on the BSD platform, in which case it can 655be disabled with `no-devcryptoeng`. 656 657### no-dynamic-engine 658 659Don't build the dynamically loaded engines. 660 661This only has an effect in a shared build. 662 663### no-ec 664 665Don't build support for Elliptic Curves. 666 667### no-ec2m 668 669Don't build support for binary Elliptic Curves 670 671### enable-ec_nistp_64_gcc_128 672 673Enable support for optimised implementations of some commonly used NIST 674elliptic curves. 675 676This option is only supported on platforms: 677 678 - with little-endian storage of non-byte types 679 - that tolerate misaligned memory references 680 - where the compiler: 681 - supports the non-standard type `__uint128_t` 682 - defines the built-in macro `__SIZEOF_INT128__` 683 684### enable-egd 685 686Build support for gathering entropy from the Entropy Gathering Daemon (EGD). 687 688### no-engine 689 690Don't build support for loading engines. 691 692### no-err 693 694Don't compile in any error strings. 695 696### enable-external-tests 697 698Enable building of integration with external test suites. 699 700This is a developer option and may not work on all platforms. The following 701external test suites are currently supported: 702 703 - GOST engine test suite 704 - Python PYCA/Cryptography test suite 705 - krb5 test suite 706 707See the file [test/README-external.md](test/README-external.md) 708for further details. 709 710### no-filenames 711 712Don't compile in filename and line number information (e.g. for errors and 713memory allocation). 714 715### enable-fips 716 717Build (and install) the FIPS provider 718 719### no-fips-securitychecks 720 721Don't perform FIPS module run-time checks related to enforcement of security 722parameters such as minimum security strength of keys. 723 724### enable-fuzz-libfuzzer, enable-fuzz-afl 725 726Build with support for fuzzing using either libfuzzer or AFL. 727 728These are developer options only. They may not work on all platforms and 729should never be used in production environments. 730 731See the file [fuzz/README.md](fuzz/README.md) for further details. 732 733### no-gost 734 735Don't build support for GOST based ciphersuites. 736 737Note that if this feature is enabled then GOST ciphersuites are only available 738if the GOST algorithms are also available through loading an externally supplied 739engine. 740 741### no-legacy 742 743Don't build the legacy provider. 744 745Disabling this also disables the legacy algorithms: MD2 (already disabled by default). 746 747### no-makedepend 748 749Don't generate dependencies. 750 751### no-module 752 753Don't build any dynamically loadable engines. 754 755This also implies `no-dynamic-engine`. 756 757### no-multiblock 758 759Don't build support for writing multiple records in one go in libssl 760 761Note: this is a different capability to the pipelining functionality. 762 763### no-nextprotoneg 764 765Don't build support for the Next Protocol Negotiation (NPN) TLS extension. 766 767### no-ocsp 768 769Don't build support for Online Certificate Status Protocol (OCSP). 770 771### no-padlockeng 772 773Don't build the padlock engine. 774 775### no-hw-padlock 776 777As synonym for `no-padlockeng`. Deprecated and should not be used. 778 779### no-pic 780 781Don't build with support for Position Independent Code. 782 783### no-pinshared 784 785Don't pin the shared libraries. 786 787By default OpenSSL will attempt to stay in memory until the process exits. 788This is so that libcrypto and libssl can be properly cleaned up automatically 789via an `atexit()` handler. The handler is registered by libcrypto and cleans 790up both libraries. On some platforms the `atexit()` handler will run on unload of 791libcrypto (if it has been dynamically loaded) rather than at process exit. This 792option can be used to stop OpenSSL from attempting to stay in memory until the 793process exits. This could lead to crashes if either libcrypto or libssl have 794already been unloaded at the point that the atexit handler is invoked, e.g. on a 795platform which calls `atexit()` on unload of the library, and libssl is unloaded 796before libcrypto then a crash is likely to happen. Applications can suppress 797running of the `atexit()` handler at run time by using the 798`OPENSSL_INIT_NO_ATEXIT` option to `OPENSSL_init_crypto()`. 799See the man page for it for further details. 800 801### no-posix-io 802 803Don't use POSIX IO capabilities. 804 805### no-psk 806 807Don't build support for Pre-Shared Key based ciphersuites. 808 809### no-rdrand 810 811Don't use hardware RDRAND capabilities. 812 813### no-rfc3779 814 815Don't build support for RFC3779, "X.509 Extensions for IP Addresses and 816AS Identifiers". 817 818### sctp 819 820Build support for Stream Control Transmission Protocol (SCTP). 821 822### no-shared 823 824Do not create shared libraries, only static ones. 825 826See [Notes on shared libraries](#notes-on-shared-libraries) below. 827 828### no-sock 829 830Don't build support for socket BIOs. 831 832### no-srp 833 834Don't build support for Secure Remote Password (SRP) protocol or 835SRP based ciphersuites. 836 837### no-srtp 838 839Don't build Secure Real-Time Transport Protocol (SRTP) support. 840 841### no-sse2 842 843Exclude SSE2 code paths from 32-bit x86 assembly modules. 844 845Normally SSE2 extension is detected at run-time, but the decision whether or not 846the machine code will be executed is taken solely on CPU capability vector. This 847means that if you happen to run OS kernel which does not support SSE2 extension 848on Intel P4 processor, then your application might be exposed to "illegal 849instruction" exception. There might be a way to enable support in kernel, e.g. 850FreeBSD kernel can be compiled with `CPU_ENABLE_SSE`, and there is a way to 851disengage SSE2 code paths upon application start-up, but if you aim for wider 852"audience" running such kernel, consider `no-sse2`. Both the `386` and `no-asm` 853options imply `no-sse2`. 854 855### no-ssl-trace 856 857Don't build with SSL Trace capabilities. 858 859This removes the `-trace` option from `s_client` and `s_server`, and omits the 860`SSL_trace()` function from libssl. 861 862Disabling `ssl-trace` may provide a small reduction in libssl binary size. 863 864### no-static-engine 865 866Don't build the statically linked engines. 867 868This only has an impact when not built "shared". 869 870### no-stdio 871 872Don't use anything from the C header file `stdio.h` that makes use of the `FILE` 873type. Only libcrypto and libssl can be built in this way. Using this option will 874suppress building the command line applications. Additionally, since the OpenSSL 875tests also use the command line applications, the tests will also be skipped. 876 877### no-tests 878 879Don't build test programs or run any tests. 880 881### enable-tfo 882 883Build with support for TCP Fast Open (RFC7413). Supported on Linux, macOS and FreeBSD. 884 885### enable-quic 886 887Build with QUIC support. This is currently just for developers as the 888implementation is by no means complete and usable. 889 890### no-threads 891 892Don't build with support for multi-threaded applications. 893 894### threads 895 896Build with support for multi-threaded applications. Most platforms will enable 897this by default. However, if on a platform where this is not the case then this 898will usually require additional system-dependent options! 899 900See [Notes on multi-threading](#notes-on-multi-threading) below. 901 902### enable-trace 903 904Build with support for the integrated tracing api. 905 906See manual pages OSSL_trace_set_channel(3) and OSSL_trace_enabled(3) for details. 907 908### no-ts 909 910Don't build Time Stamping (TS) Authority support. 911 912### enable-ubsan 913 914Build with the Undefined Behaviour sanitiser (UBSAN). 915 916This is a developer option only. It may not work on all platforms and should 917never be used in production environments. It will only work when used with 918gcc or clang and should be used in conjunction with the `-DPEDANTIC` option 919(or the `--strict-warnings` option). 920 921### no-ui-console 922 923Don't build with the User Interface (UI) console method 924 925The User Interface console method enables text based console prompts. 926 927### enable-unit-test 928 929Enable additional unit test APIs. 930 931This should not typically be used in production deployments. 932 933### no-uplink 934 935Don't build support for UPLINK interface. 936 937### enable-weak-ssl-ciphers 938 939Build support for SSL/TLS ciphers that are considered "weak" 940 941Enabling this includes for example the RC4 based ciphersuites. 942 943### zlib 944 945Build with support for zlib compression/decompression. 946 947### zlib-dynamic 948 949Like the zlib option, but has OpenSSL load the zlib library dynamically 950when needed. 951 952This is only supported on systems where loading of shared libraries is supported. 953 954### 386 955 956In 32-bit x86 builds, use the 80386 instruction set only in assembly modules 957 958The default x86 code is more efficient, but requires at least an 486 processor. 959Note: This doesn't affect compiler generated code, so this option needs to be 960accompanied by a corresponding compiler-specific option. 961 962### no-{protocol} 963 964 no-{ssl|ssl3|tls|tls1|tls1_1|tls1_2|tls1_3|dtls|dtls1|dtls1_2} 965 966Don't build support for negotiating the specified SSL/TLS protocol. 967 968If `no-tls` is selected then all of `tls1`, `tls1_1`, `tls1_2` and `tls1_3` 969are disabled. 970Similarly `no-dtls` will disable `dtls1` and `dtls1_2`. The `no-ssl` option is 971synonymous with `no-ssl3`. Note this only affects version negotiation. 972OpenSSL will still provide the methods for applications to explicitly select 973the individual protocol versions. 974 975### no-{protocol}-method 976 977 no-{ssl3|tls1|tls1_1|tls1_2|dtls1|dtls1_2}-method 978 979Analogous to `no-{protocol}` but in addition do not build the methods for 980applications to explicitly select individual protocol versions. Note that there 981is no `no-tls1_3-method` option because there is no application method for 982TLSv1.3. 983 984Using individual protocol methods directly is deprecated. Applications should 985use `TLS_method()` instead. 986 987### enable-{algorithm} 988 989 enable-{md2|rc5} 990 991Build with support for the specified algorithm. 992 993### no-{algorithm} 994 995 no-{aria|bf|blake2|camellia|cast|chacha|cmac| 996 des|dh|dsa|ecdh|ecdsa|idea|md4|mdc2|ocb| 997 poly1305|rc2|rc4|rmd160|scrypt|seed| 998 siphash|siv|sm2|sm3|sm4|whirlpool} 999 1000Build without support for the specified algorithm. 1001 1002The `ripemd` algorithm is deprecated and if used is synonymous with `rmd160`. 1003 1004### Compiler-specific options 1005 1006 -Dxxx, -Ixxx, -Wp, -lxxx, -Lxxx, -Wl, -rpath, -R, -framework, -static 1007 1008These system specific options will be recognised and passed through to the 1009compiler to allow you to define preprocessor symbols, specify additional 1010libraries, library directories or other compiler options. It might be worth 1011noting that some compilers generate code specifically for processor the 1012compiler currently executes on. This is not necessarily what you might have 1013in mind, since it might be unsuitable for execution on other, typically older, 1014processor. Consult your compiler documentation. 1015 1016Take note of the [Environment Variables](#environment-variables) documentation 1017below and how these flags interact with those variables. 1018 1019 -xxx, +xxx, /xxx 1020 1021Additional options that are not otherwise recognised are passed through as 1022they are to the compiler as well. Unix-style options beginning with a 1023`-` or `+` and Windows-style options beginning with a `/` are recognized. 1024Again, consult your compiler documentation. 1025 1026If the option contains arguments separated by spaces, then the URL-style 1027notation `%20` can be used for the space character in order to avoid having 1028to quote the option. For example, `-opt%20arg` gets expanded to `-opt arg`. 1029In fact, any ASCII character can be encoded as %xx using its hexadecimal 1030encoding. 1031 1032Take note of the [Environment Variables](#environment-variables) documentation 1033below and how these flags interact with those variables. 1034 1035### Environment Variables 1036 1037 VAR=value 1038 1039Assign the given value to the environment variable `VAR` for `Configure`. 1040 1041These work just like normal environment variable assignments, but are supported 1042on all platforms and are confined to the configuration scripts only. 1043These assignments override the corresponding value in the inherited environment, 1044if there is one. 1045 1046The following variables are used as "`make` variables" and can be used as an 1047alternative to giving preprocessor, compiler and linker options directly as 1048configuration. The following variables are supported: 1049 1050 AR The static library archiver. 1051 ARFLAGS Flags for the static library archiver. 1052 AS The assembler compiler. 1053 ASFLAGS Flags for the assembler compiler. 1054 CC The C compiler. 1055 CFLAGS Flags for the C compiler. 1056 CXX The C++ compiler. 1057 CXXFLAGS Flags for the C++ compiler. 1058 CPP The C/C++ preprocessor. 1059 CPPFLAGS Flags for the C/C++ preprocessor. 1060 CPPDEFINES List of CPP macro definitions, separated 1061 by a platform specific character (':' or 1062 space for Unix, ';' for Windows, ',' for 1063 VMS). This can be used instead of using 1064 -D (or what corresponds to that on your 1065 compiler) in CPPFLAGS. 1066 CPPINCLUDES List of CPP inclusion directories, separated 1067 the same way as for CPPDEFINES. This can 1068 be used instead of -I (or what corresponds 1069 to that on your compiler) in CPPFLAGS. 1070 HASHBANGPERL Perl invocation to be inserted after '#!' 1071 in public perl scripts (only relevant on 1072 Unix). 1073 LD The program linker (not used on Unix, $(CC) 1074 is used there). 1075 LDFLAGS Flags for the shared library, DSO and 1076 program linker. 1077 LDLIBS Extra libraries to use when linking. 1078 Takes the form of a space separated list 1079 of library specifications on Unix and 1080 Windows, and as a comma separated list of 1081 libraries on VMS. 1082 RANLIB The library archive indexer. 1083 RC The Windows resource compiler. 1084 RCFLAGS Flags for the Windows resource compiler. 1085 RM The command to remove files and directories. 1086 1087These cannot be mixed with compiling/linking flags given on the command line. 1088In other words, something like this isn't permitted. 1089 1090 $ ./Configure -DFOO CPPFLAGS=-DBAR -DCOOKIE 1091 1092Backward compatibility note: 1093 1094To be compatible with older configuration scripts, the environment variables 1095are ignored if compiling/linking flags are given on the command line, except 1096for the following: 1097 1098 AR, CC, CXX, CROSS_COMPILE, HASHBANGPERL, PERL, RANLIB, RC, and WINDRES 1099 1100For example, the following command will not see `-DBAR`: 1101 1102 $ CPPFLAGS=-DBAR ./Configure -DCOOKIE 1103 1104However, the following will see both set variables: 1105 1106 $ CC=gcc CROSS_COMPILE=x86_64-w64-mingw32- ./Configure -DCOOKIE 1107 1108If `CC` is set, it is advisable to also set `CXX` to ensure both the C and C++ 1109compiler are in the same "family". This becomes relevant with 1110`enable-external-tests` and `enable-buildtest-c++`. 1111 1112### Reconfigure 1113 1114 reconf 1115 reconfigure 1116 1117Reconfigure from earlier data. 1118 1119This fetches the previous command line options and environment from data 1120saved in `configdata.pm` and runs the configuration process again, using 1121these options and environment. Note: NO other option is permitted together 1122with `reconf`. Note: The original configuration saves away values for ALL 1123environment variables that were used, and if they weren't defined, they are 1124still saved away with information that they weren't originally defined. 1125This information takes precedence over environment variables that are 1126defined when reconfiguring. 1127 1128Displaying configuration data 1129----------------------------- 1130 1131The configuration script itself will say very little, and finishes by 1132creating `configdata.pm`. This perl module can be loaded by other scripts 1133to find all the configuration data, and it can also be used as a script to 1134display all sorts of configuration data in a human readable form. 1135 1136For more information, please do: 1137 1138 $ ./configdata.pm --help # Unix 1139 1140or 1141 1142 $ perl configdata.pm --help # Windows and VMS 1143 1144Installation Steps in Detail 1145============================ 1146 1147Configure OpenSSL 1148----------------- 1149 1150### Automatic Configuration 1151 1152In previous version, the `config` script determined the platform type and 1153compiler and then called `Configure`. Starting with this release, they are 1154the same. 1155 1156#### Unix / Linux / macOS 1157 1158 $ ./Configure [options...] 1159 1160#### OpenVMS 1161 1162 $ perl Configure [options...] 1163 1164#### Windows 1165 1166 $ perl Configure [options...] 1167 1168### Manual Configuration 1169 1170OpenSSL knows about a range of different operating system, hardware and 1171compiler combinations. To see the ones it knows about, run 1172 1173 $ ./Configure LIST # Unix 1174 1175or 1176 1177 $ perl Configure LIST # All other platforms 1178 1179For the remainder of this text, the Unix form will be used in all examples. 1180Please use the appropriate form for your platform. 1181 1182Pick a suitable name from the list that matches your system. For most 1183operating systems there is a choice between using cc or gcc. 1184When you have identified your system (and if necessary compiler) use this 1185name as the argument to `Configure`. For example, a `linux-elf` user would 1186run: 1187 1188 $ ./Configure linux-elf [options...] 1189 1190### Creating your own Configuration 1191 1192If your system isn't listed, you will have to create a configuration 1193file named `Configurations/YOURFILENAME.conf` (replace `YOURFILENAME` 1194with a filename of your choosing) and add the correct 1195configuration for your system. See the available configs as examples 1196and read [Configurations/README.md](Configurations/README.md) and 1197[Configurations/README-design.md](Configurations/README-design.md) 1198for more information. 1199 1200The generic configurations `cc` or `gcc` should usually work on 32 bit 1201Unix-like systems. 1202 1203`Configure` creates a build file (`Makefile` on Unix, `makefile` on Windows 1204and `descrip.mms` on OpenVMS) from a suitable template in `Configurations/`, 1205and defines various macros in `include/openssl/configuration.h` (generated 1206from `include/openssl/configuration.h.in`. 1207 1208### Out of Tree Builds 1209 1210OpenSSL can be configured to build in a build directory separate from the 1211source code directory. It's done by placing yourself in some other 1212directory and invoking the configuration commands from there. 1213 1214#### Unix example 1215 1216 $ mkdir /var/tmp/openssl-build 1217 $ cd /var/tmp/openssl-build 1218 $ /PATH/TO/OPENSSL/SOURCE/Configure [options...] 1219 1220#### OpenVMS example 1221 1222 $ set default sys$login: 1223 $ create/dir [.tmp.openssl-build] 1224 $ set default [.tmp.openssl-build] 1225 $ perl D:[PATH.TO.OPENSSL.SOURCE]Configure [options...] 1226 1227#### Windows example 1228 1229 $ C: 1230 $ mkdir \temp-openssl 1231 $ cd \temp-openssl 1232 $ perl d:\PATH\TO\OPENSSL\SOURCE\Configure [options...] 1233 1234Paths can be relative just as well as absolute. `Configure` will do its best 1235to translate them to relative paths whenever possible. 1236 1237Build OpenSSL 1238------------- 1239 1240Build OpenSSL by running: 1241 1242 $ make # Unix 1243 $ mms ! (or mmk) OpenVMS 1244 $ nmake # Windows 1245 1246This will build the OpenSSL libraries (`libcrypto.a` and `libssl.a` on 1247Unix, corresponding on other platforms) and the OpenSSL binary 1248(`openssl`). The libraries will be built in the top-level directory, 1249and the binary will be in the `apps/` subdirectory. 1250 1251If the build fails, take a look at the [Build Failures](#build-failures) 1252subsection of the [Troubleshooting](#troubleshooting) section. 1253 1254Test OpenSSL 1255------------ 1256 1257After a successful build, and before installing, the libraries should 1258be tested. Run: 1259 1260 $ make test # Unix 1261 $ mms test ! OpenVMS 1262 $ nmake test # Windows 1263 1264**Warning:** you MUST run the tests from an unprivileged account (or disable 1265your privileges temporarily if your platform allows it). 1266 1267See [test/README.md](test/README.md) for further details how run tests. 1268 1269See [test/README-dev.md](test/README-dev.md) for guidelines on adding tests. 1270 1271Install OpenSSL 1272--------------- 1273 1274If everything tests ok, install OpenSSL with 1275 1276 $ make install # Unix 1277 $ mms install ! OpenVMS 1278 $ nmake install # Windows 1279 1280Note that in order to perform the install step above you need to have 1281appropriate permissions to write to the installation directory. 1282 1283The above commands will install all the software components in this 1284directory tree under `<PREFIX>` (the directory given with `--prefix` or 1285its default): 1286 1287### Unix / Linux / macOS 1288 1289 bin/ Contains the openssl binary and a few other 1290 utility scripts. 1291 include/openssl 1292 Contains the header files needed if you want 1293 to build your own programs that use libcrypto 1294 or libssl. 1295 lib Contains the OpenSSL library files. 1296 lib/engines Contains the OpenSSL dynamically loadable engines. 1297 1298 share/man/man1 Contains the OpenSSL command line man-pages. 1299 share/man/man3 Contains the OpenSSL library calls man-pages. 1300 share/man/man5 Contains the OpenSSL configuration format man-pages. 1301 share/man/man7 Contains the OpenSSL other misc man-pages. 1302 1303 share/doc/openssl/html/man1 1304 share/doc/openssl/html/man3 1305 share/doc/openssl/html/man5 1306 share/doc/openssl/html/man7 1307 Contains the HTML rendition of the man-pages. 1308 1309### OpenVMS 1310 1311'arch' is replaced with the architecture name, `ALPHA` or `IA64`, 1312'sover' is replaced with the shared library version (`0101` for 1.1), and 1313'pz' is replaced with the pointer size OpenSSL was built with: 1314 1315 [.EXE.'arch'] Contains the openssl binary. 1316 [.EXE] Contains a few utility scripts. 1317 [.include.openssl] 1318 Contains the header files needed if you want 1319 to build your own programs that use libcrypto 1320 or libssl. 1321 [.LIB.'arch'] Contains the OpenSSL library files. 1322 [.ENGINES'sover''pz'.'arch'] 1323 Contains the OpenSSL dynamically loadable engines. 1324 [.SYS$STARTUP] Contains startup, login and shutdown scripts. 1325 These define appropriate logical names and 1326 command symbols. 1327 [.SYSTEST] Contains the installation verification procedure. 1328 [.HTML] Contains the HTML rendition of the manual pages. 1329 1330### Additional Directories 1331 1332Additionally, install will add the following directories under 1333OPENSSLDIR (the directory given with `--openssldir` or its default) 1334for you convenience: 1335 1336 certs Initially empty, this is the default location 1337 for certificate files. 1338 private Initially empty, this is the default location 1339 for private key files. 1340 misc Various scripts. 1341 1342The installation directory should be appropriately protected to ensure 1343unprivileged users cannot make changes to OpenSSL binaries or files, or 1344install engines. If you already have a pre-installed version of OpenSSL as 1345part of your Operating System it is recommended that you do not overwrite 1346the system version and instead install to somewhere else. 1347 1348Package builders who want to configure the library for standard locations, 1349but have the package installed somewhere else so that it can easily be 1350packaged, can use 1351 1352 $ make DESTDIR=/tmp/package-root install # Unix 1353 $ mms/macro="DESTDIR=TMP:[PACKAGE-ROOT]" install ! OpenVMS 1354 1355The specified destination directory will be prepended to all installation 1356target paths. 1357 1358Compatibility issues with previous OpenSSL versions 1359--------------------------------------------------- 1360 1361### COMPILING existing applications 1362 1363Starting with version 1.1.0, OpenSSL hides a number of structures that were 1364previously open. This includes all internal libssl structures and a number 1365of EVP types. Accessor functions have been added to allow controlled access 1366to the structures' data. 1367 1368This means that some software needs to be rewritten to adapt to the new ways 1369of doing things. This often amounts to allocating an instance of a structure 1370explicitly where you could previously allocate them on the stack as automatic 1371variables, and using the provided accessor functions where you would previously 1372access a structure's field directly. 1373 1374Some APIs have changed as well. However, older APIs have been preserved when 1375possible. 1376 1377Post-installation Notes 1378----------------------- 1379 1380With the default OpenSSL installation comes a FIPS provider module, which 1381needs some post-installation attention, without which it will not be usable. 1382This involves using the following command: 1383 1384 $ openssl fipsinstall 1385 1386See the openssl-fipsinstall(1) manual for details and examples. 1387 1388Advanced Build Options 1389====================== 1390 1391Environment Variables 1392--------------------- 1393 1394A number of environment variables can be used to provide additional control 1395over the build process. Typically these should be defined prior to running 1396`Configure`. Not all environment variables are relevant to all platforms. 1397 1398 AR 1399 The name of the ar executable to use. 1400 1401 BUILDFILE 1402 Use a different build file name than the platform default 1403 ("Makefile" on Unix-like platforms, "makefile" on native Windows, 1404 "descrip.mms" on OpenVMS). This requires that there is a 1405 corresponding build file template. 1406 See [Configurations/README.md](Configurations/README.md) 1407 for further information. 1408 1409 CC 1410 The compiler to use. Configure will attempt to pick a default 1411 compiler for your platform but this choice can be overridden 1412 using this variable. Set it to the compiler executable you wish 1413 to use, e.g. gcc or clang. 1414 1415 CROSS_COMPILE 1416 This environment variable has the same meaning as for the 1417 "--cross-compile-prefix" Configure flag described above. If both 1418 are set then the Configure flag takes precedence. 1419 1420 HASHBANGPERL 1421 The command string for the Perl executable to insert in the 1422 #! line of perl scripts that will be publicly installed. 1423 Default: /usr/bin/env perl 1424 Note: the value of this variable is added to the same scripts 1425 on all platforms, but it's only relevant on Unix-like platforms. 1426 1427 KERNEL_BITS 1428 This can be the value `32` or `64` to specify the architecture 1429 when it is not "obvious" to the configuration. It should generally 1430 not be necessary to specify this environment variable. 1431 1432 NM 1433 The name of the nm executable to use. 1434 1435 OPENSSL_LOCAL_CONFIG_DIR 1436 OpenSSL comes with a database of information about how it 1437 should be built on different platforms as well as build file 1438 templates for those platforms. The database is comprised of 1439 ".conf" files in the Configurations directory. The build 1440 file templates reside there as well as ".tmpl" files. See the 1441 file [Configurations/README.md](Configurations/README.md) 1442 for further information about the format of ".conf" files 1443 as well as information on the ".tmpl" files. 1444 In addition to the standard ".conf" and ".tmpl" files, it is 1445 possible to create your own ".conf" and ".tmpl" files and 1446 store them locally, outside the OpenSSL source tree. 1447 This environment variable can be set to the directory where 1448 these files are held and will be considered by Configure 1449 before it looks in the standard directories. 1450 1451 PERL 1452 The name of the Perl executable to use when building OpenSSL. 1453 Only needed if builing should use a different Perl executable 1454 than what is used to run the Configure script. 1455 1456 RANLIB 1457 The name of the ranlib executable to use. 1458 1459 RC 1460 The name of the rc executable to use. The default will be as 1461 defined for the target platform in the ".conf" file. If not 1462 defined then "windres" will be used. The WINDRES environment 1463 variable is synonymous to this. If both are defined then RC 1464 takes precedence. 1465 1466 WINDRES 1467 See RC. 1468 1469Makefile Targets 1470---------------- 1471 1472The `Configure` script generates a Makefile in a format relevant to the specific 1473platform. The Makefiles provide a number of targets that can be used. Not all 1474targets may be available on all platforms. Only the most common targets are 1475described here. Examine the Makefiles themselves for the full list. 1476 1477 all 1478 The target to build all the software components and 1479 documentation. 1480 1481 build_sw 1482 Build all the software components. 1483 THIS IS THE DEFAULT TARGET. 1484 1485 build_docs 1486 Build all documentation components. 1487 1488 clean 1489 Remove all build artefacts and return the directory to a "clean" 1490 state. 1491 1492 depend 1493 Rebuild the dependencies in the Makefiles. This is a legacy 1494 option that no longer needs to be used since OpenSSL 1.1.0. 1495 1496 install 1497 Install all OpenSSL components. 1498 1499 install_sw 1500 Only install the OpenSSL software components. 1501 1502 install_docs 1503 Only install the OpenSSL documentation components. 1504 1505 install_man_docs 1506 Only install the OpenSSL man pages (Unix only). 1507 1508 install_html_docs 1509 Only install the OpenSSL HTML documentation. 1510 1511 install_fips 1512 Install the FIPS provider module configuration file. 1513 1514 list-tests 1515 Prints a list of all the self test names. 1516 1517 test 1518 Build and run the OpenSSL self tests. 1519 1520 uninstall 1521 Uninstall all OpenSSL components. 1522 1523 reconfigure 1524 reconf 1525 Re-run the configuration process, as exactly as the last time 1526 as possible. 1527 1528 update 1529 This is a developer option. If you are developing a patch for 1530 OpenSSL you may need to use this if you want to update 1531 automatically generated files; add new error codes or add new 1532 (or change the visibility of) public API functions. (Unix only). 1533 1534Running Selected Tests 1535---------------------- 1536 1537You can specify a set of tests to be performed 1538using the `make` variable `TESTS`. 1539 1540See the section [Running Selected Tests of 1541test/README.md](test/README.md#running-selected-tests). 1542 1543Troubleshooting 1544=============== 1545 1546Configuration Problems 1547---------------------- 1548 1549### Selecting the correct target 1550 1551The `./Configure` script tries hard to guess your operating system, but in some 1552cases it does not succeed. You will see a message like the following: 1553 1554 $ ./Configure 1555 Operating system: x86-whatever-minix 1556 This system (minix) is not supported. See file INSTALL.md for details. 1557 1558Even if the automatic target selection by the `./Configure` script fails, 1559chances are that you still might find a suitable target in the `Configurations` 1560directory, which you can supply to the `./Configure` command, 1561possibly after some adjustment. 1562 1563The `Configurations/` directory contains a lot of examples of such targets. 1564The main configuration file is [10-main.conf], which contains all targets that 1565are officially supported by the OpenSSL team. Other configuration files contain 1566targets contributed by other OpenSSL users. The list of targets can be found in 1567a Perl list `my %targets = ( ... )`. 1568 1569 my %targets = ( 1570 ... 1571 "target-name" => { 1572 inherit_from => [ "base-target" ], 1573 CC => "...", 1574 cflags => add("..."), 1575 asm_arch => '...', 1576 perlasm_scheme => "...", 1577 }, 1578 ... 1579 ) 1580 1581If you call `./Configure` without arguments, it will give you a list of all 1582known targets. Using `grep`, you can lookup the target definition in the 1583`Configurations/` directory. For example the `android-x86_64` can be found in 1584[Configurations/15-android.conf](Configurations/15-android.conf). 1585 1586The directory contains two README files, which explain the general syntax and 1587design of the configuration files. 1588 1589 - [Configurations/README.md](Configurations/README.md) 1590 - [Configurations/README-design.md](Configurations/README-design.md) 1591 1592If you need further help, try to search the [openssl-users] mailing list 1593or the [GitHub Issues] for existing solutions. If you don't find anything, 1594you can [raise an issue] to ask a question yourself. 1595 1596More about our support resources can be found in the [SUPPORT] file. 1597 1598### Configuration Errors 1599 1600If the `./Configure` or `./Configure` command fails with an error message, 1601read the error message carefully and try to figure out whether you made 1602a mistake (e.g., by providing a wrong option), or whether the script is 1603working incorrectly. If you think you encountered a bug, please 1604[raise an issue] on GitHub to file a bug report. 1605 1606Along with a short description of the bug, please provide the complete 1607configure command line and the relevant output including the error message. 1608 1609Note: To make the output readable, please add a 'code fence' (three backquotes 1610` ``` ` on a separate line) before and after your output: 1611 1612 ``` 1613 ./Configure [your arguments...] 1614 1615 [output...] 1616 1617 ``` 1618 1619Build Failures 1620-------------- 1621 1622If the build fails, look carefully at the output. Try to locate and understand 1623the error message. It might be that the compiler is already telling you 1624exactly what you need to do to fix your problem. 1625 1626There may be reasons for the failure that aren't problems in OpenSSL itself, 1627for example if the compiler reports missing standard or third party headers. 1628 1629If the build succeeded previously, but fails after a source or configuration 1630change, it might be helpful to clean the build tree before attempting another 1631build. Use this command: 1632 1633 $ make clean # Unix 1634 $ mms clean ! (or mmk) OpenVMS 1635 $ nmake clean # Windows 1636 1637Assembler error messages can sometimes be sidestepped by using the `no-asm` 1638configuration option. See also [notes](#notes-on-assembler-modules-compilation). 1639 1640Compiling parts of OpenSSL with gcc and others with the system compiler will 1641result in unresolved symbols on some systems. 1642 1643If you are still having problems, try to search the [openssl-users] mailing 1644list or the [GitHub Issues] for existing solutions. If you think you 1645encountered an OpenSSL bug, please [raise an issue] to file a bug report. 1646Please take the time to review the existing issues first; maybe the bug was 1647already reported or has already been fixed. 1648 1649Test Failures 1650------------- 1651 1652If some tests fail, look at the output. There may be reasons for the failure 1653that isn't a problem in OpenSSL itself (like an OS malfunction or a Perl issue). 1654 1655You may want increased verbosity, that can be accomplished as described in 1656section [Test Failures of test/README.md](test/README.md#test-failures). 1657 1658You may also want to selectively specify which test(s) to perform. This can be 1659done using the `make` variable `TESTS` as described in section [Running 1660Selected Tests of test/README.md](test/README.md#running-selected-tests). 1661 1662If you find a problem with OpenSSL itself, try removing any 1663compiler optimization flags from the `CFLAGS` line in the Makefile and 1664run `make clean; make` or corresponding. 1665 1666To report a bug please open an issue on GitHub, at 1667<https://github.com/openssl/openssl/issues>. 1668 1669Notes 1670===== 1671 1672Notes on multi-threading 1673------------------------ 1674 1675For some systems, the OpenSSL `Configure` script knows what compiler options 1676are needed to generate a library that is suitable for multi-threaded 1677applications. On these systems, support for multi-threading is enabled 1678by default; use the `no-threads` option to disable (this should never be 1679necessary). 1680 1681On other systems, to enable support for multi-threading, you will have 1682to specify at least two options: `threads`, and a system-dependent option. 1683(The latter is `-D_REENTRANT` on various systems.) The default in this 1684case, obviously, is not to include support for multi-threading (but 1685you can still use `no-threads` to suppress an annoying warning message 1686from the `Configure` script.) 1687 1688OpenSSL provides built-in support for two threading models: pthreads (found on 1689most UNIX/Linux systems), and Windows threads. No other threading models are 1690supported. If your platform does not provide pthreads or Windows threads then 1691you should use `Configure` with the `no-threads` option. 1692 1693For pthreads, all locks are non-recursive. In addition, in a debug build, 1694the mutex attribute `PTHREAD_MUTEX_ERRORCHECK` is used. If this is not 1695available on your platform, you might have to add 1696`-DOPENSSL_NO_MUTEX_ERRORCHECK` to your `Configure` invocation. 1697(On Linux `PTHREAD_MUTEX_ERRORCHECK` is an enum value, so a built-in 1698ifdef test cannot be used.) 1699 1700Notes on shared libraries 1701------------------------- 1702 1703For most systems the OpenSSL `Configure` script knows what is needed to 1704build shared libraries for libcrypto and libssl. On these systems 1705the shared libraries will be created by default. This can be suppressed and 1706only static libraries created by using the `no-shared` option. On systems 1707where OpenSSL does not know how to build shared libraries the `no-shared` 1708option will be forced and only static libraries will be created. 1709 1710Shared libraries are named a little differently on different platforms. 1711One way or another, they all have the major OpenSSL version number as 1712part of the file name, i.e. for OpenSSL 1.1.x, `1.1` is somehow part of 1713the name. 1714 1715On most POSIX platforms, shared libraries are named `libcrypto.so.1.1` 1716and `libssl.so.1.1`. 1717 1718on Cygwin, shared libraries are named `cygcrypto-1.1.dll` and `cygssl-1.1.dll` 1719with import libraries `libcrypto.dll.a` and `libssl.dll.a`. 1720 1721On Windows build with MSVC or using MingW, shared libraries are named 1722`libcrypto-1_1.dll` and `libssl-1_1.dll` for 32-bit Windows, 1723`libcrypto-1_1-x64.dll` and `libssl-1_1-x64.dll` for 64-bit x86_64 Windows, 1724and `libcrypto-1_1-ia64.dll` and `libssl-1_1-ia64.dll` for IA64 Windows. 1725With MSVC, the import libraries are named `libcrypto.lib` and `libssl.lib`, 1726while with MingW, they are named `libcrypto.dll.a` and `libssl.dll.a`. 1727 1728On VMS, shareable images (VMS speak for shared libraries) are named 1729`ossl$libcrypto0101_shr.exe` and `ossl$libssl0101_shr.exe`. However, when 1730OpenSSL is specifically built for 32-bit pointers, the shareable images 1731are named `ossl$libcrypto0101_shr32.exe` and `ossl$libssl0101_shr32.exe` 1732instead, and when built for 64-bit pointers, they are named 1733`ossl$libcrypto0101_shr64.exe` and `ossl$libssl0101_shr64.exe`. 1734 1735Notes on random number generation 1736--------------------------------- 1737 1738Availability of cryptographically secure random numbers is required for 1739secret key generation. OpenSSL provides several options to seed the 1740internal CSPRNG. If not properly seeded, the internal CSPRNG will refuse 1741to deliver random bytes and a "PRNG not seeded error" will occur. 1742 1743The seeding method can be configured using the `--with-rand-seed` option, 1744which can be used to specify a comma separated list of seed methods. 1745However, in most cases OpenSSL will choose a suitable default method, 1746so it is not necessary to explicitly provide this option. Note also 1747that not all methods are available on all platforms. The FIPS provider will 1748silently ignore seed sources that were not validated. 1749 1750I) On operating systems which provide a suitable randomness source (in 1751form of a system call or system device), OpenSSL will use the optimal 1752available method to seed the CSPRNG from the operating system's 1753randomness sources. This corresponds to the option `--with-rand-seed=os`. 1754 1755II) On systems without such a suitable randomness source, automatic seeding 1756and reseeding is disabled (`--with-rand-seed=none`) and it may be necessary 1757to install additional support software to obtain a random seed and reseed 1758the CSPRNG manually. Please check out the manual pages for `RAND_add()`, 1759`RAND_bytes()`, `RAND_egd()`, and the FAQ for more information. 1760 1761Notes on assembler modules compilation 1762-------------------------------------- 1763 1764Compilation of some code paths in assembler modules might depend on whether the 1765current assembler version supports certain ISA extensions or not. Code paths 1766that use the AES-NI, PCLMULQDQ, SSSE3, and SHA extensions are always assembled. 1767Apart from that, the minimum requirements for the assembler versions are shown 1768in the table below: 1769 1770| ISA extension | GNU as | nasm | llvm | 1771|---------------|--------|--------|---------| 1772| AVX | 2.19 | 2.09 | 3.0 | 1773| AVX2 | 2.22 | 2.10 | 3.1 | 1774| ADCX/ADOX | 2.23 | 2.10 | 3.3 | 1775| AVX512 | 2.25 | 2.11.8 | 3.6 (*) | 1776| AVX512IFMA | 2.26 | 2.11.8 | 6.0 (*) | 1777| VAES | 2.30 | 2.13.3 | 6.0 (*) | 1778 1779--- 1780 1781(*) Even though AVX512 support was implemented in llvm 3.6, prior to version 7.0 1782an explicit -march flag was apparently required to compile assembly modules. But 1783then the compiler generates processor-specific code, which in turn contradicts 1784the idea of performing dispatch at run-time, which is facilitated by the special 1785variable `OPENSSL_ia32cap`. For versions older than 7.0, it is possible to work 1786around the problem by forcing the build procedure to use the following script: 1787 1788 #!/bin/sh 1789 exec clang -no-integrated-as "$@" 1790 1791instead of the real clang. In which case it doesn't matter what clang version 1792is used, as it is the version of the GNU assembler that will be checked. 1793 1794--- 1795 1796<!-- Links --> 1797 1798[openssl-users]: 1799 <https://mta.openssl.org/mailman/listinfo/openssl-users> 1800 1801[SUPPORT]: 1802 ./SUPPORT.md 1803 1804[GitHub Issues]: 1805 <https://github.com/openssl/openssl/issues> 1806 1807[raise an issue]: 1808 <https://github.com/openssl/openssl/issues/new/choose> 1809 1810[10-main.conf]: 1811 Configurations/10-main.conf 1812
