1Build and Install 2================= 3 4This document describes installation on all supported operating 5systems (the Unix/Linux family, including macOS), OpenVMS, 6and Windows). 7 8Table of Contents 9================= 10 11 - [Prerequisites](#prerequisites) 12 - [Notational Conventions](#notational-conventions) 13 - [Quick Installation Guide](#quick-installation-guide) 14 - [Building OpenSSL](#building-openssl) 15 - [Installing OpenSSL](#installing-openssl) 16 - [Configuration Options](#configuration-options) 17 - [API Level](#api-level) 18 - [Cross Compile Prefix](#cross-compile-prefix) 19 - [Build Type](#build-type) 20 - [Directories](#directories) 21 - [Compiler Warnings](#compiler-warnings) 22 - [ZLib Flags](#zlib-flags) 23 - [Seeding the Random Generator](#seeding-the-random-generator) 24 - [Setting the FIPS HMAC key](#setting-the-FIPS-HMAC-key) 25 - [Enable and Disable Features](#enable-and-disable-features) 26 - [Displaying configuration data](#displaying-configuration-data) 27 - [Installation Steps in Detail](#installation-steps-in-detail) 28 - [Configure](#configure-openssl) 29 - [Build](#build-openssl) 30 - [Test](#test-openssl) 31 - [Install](#install-openssl) 32 - [Advanced Build Options](#advanced-build-options) 33 - [Environment Variables](#environment-variables) 34 - [Makefile Targets](#makefile-targets) 35 - [Running Selected Tests](#running-selected-tests) 36 - [Troubleshooting](#troubleshooting) 37 - [Configuration Problems](#configuration-problems) 38 - [Build Failures](#build-failures) 39 - [Test Failures](#test-failures) 40 - [Notes](#notes) 41 - [Notes on multi-threading](#notes-on-multi-threading) 42 - [Notes on shared libraries](#notes-on-shared-libraries) 43 - [Notes on random number generation](#notes-on-random-number-generation) 44 - [Notes on assembler modules compilation](#notes-on-assembler-modules-compilation) 45 46Prerequisites 47============= 48 49To install OpenSSL, you will need: 50 51 * A "make" implementation 52 * Perl 5 with core modules (please read [NOTES-PERL.md](NOTES-PERL.md)) 53 * The Perl module `Text::Template` (please read [NOTES-PERL.md](NOTES-PERL.md)) 54 * an ANSI C compiler 55 * a development environment in the form of development libraries and C 56 header files 57 * a supported operating system 58 59For additional platform specific requirements, solutions to specific 60issues and other details, please read one of these: 61 62 * [Notes for UNIX-like platforms](NOTES-UNIX.md) 63 * [Notes for Android platforms](NOTES-ANDROID.md) 64 * [Notes for Windows platforms](NOTES-WINDOWS.md) 65 * [Notes for the DOS platform with DJGPP](NOTES-DJGPP.md) 66 * [Notes for the OpenVMS platform](NOTES-VMS.md) 67 * [Notes on Perl](NOTES-PERL.md) 68 * [Notes on Valgrind](NOTES-VALGRIND.md) 69 70Notational conventions 71====================== 72 73Throughout this document, we use the following conventions. 74 75Commands 76-------- 77 78Any line starting with a dollar sign is a command line. 79 80 $ command 81 82The dollar sign indicates the shell prompt and is not to be entered as 83part of the command. 84 85Choices 86------- 87 88Several words in curly braces separated by pipe characters indicate a 89**mandatory choice**, to be replaced with one of the given words. 90For example, the line 91 92 $ echo { WORD1 | WORD2 | WORD3 } 93 94represents one of the following three commands 95 96 $ echo WORD1 97 - or - 98 $ echo WORD2 99 - or - 100 $ echo WORD3 101 102One or several words in square brackets separated by pipe characters 103denote an **optional choice**. It is similar to the mandatory choice, 104but it can also be omitted entirely. 105 106So the line 107 108 $ echo [ WORD1 | WORD2 | WORD3 ] 109 110represents one of the four commands 111 112 $ echo WORD1 113 - or - 114 $ echo WORD2 115 - or - 116 $ echo WORD3 117 - or - 118 $ echo 119 120Arguments 121--------- 122 123**Mandatory arguments** are enclosed in double curly braces. 124A simple example would be 125 126 $ type {{ filename }} 127 128which is to be understood to use the command `type` on some file name 129determined by the user. 130 131**Optional Arguments** are enclosed in double square brackets. 132 133 [[ options ]] 134 135Note that the notation assumes spaces around `{`, `}`, `[`, `]`, `{{`, `}}` and 136`[[`, `]]`. This is to differentiate from OpenVMS directory 137specifications, which also use [ and ], but without spaces. 138 139Quick Installation Guide 140======================== 141 142If you just want to get OpenSSL installed without bothering too much 143about the details, here is the short version of how to build and install 144OpenSSL. If any of the following steps fails, please consult the 145[Installation in Detail](#installation-steps-in-detail) section below. 146 147Building OpenSSL 148---------------- 149 150Use the following commands to configure, build and test OpenSSL. 151The testing is optional, but recommended if you intend to install 152OpenSSL for production use. 153 154### Unix / Linux / macOS 155 156 $ ./Configure 157 $ make 158 $ make test 159 160### OpenVMS 161 162Use the following commands to build OpenSSL: 163 164 $ perl Configure 165 $ mms 166 $ mms test 167 168### Windows 169 170If you are using Visual Studio, open a Developer Command Prompt and 171issue the following commands to build OpenSSL. 172 173 $ perl Configure 174 $ nmake 175 $ nmake test 176 177As mentioned in the [Choices](#choices) section, you need to pick one 178of the four Configure targets in the first command. 179 180Most likely you will be using the `VC-WIN64A` target for 64bit Windows 181binaries (AMD64) or `VC-WIN32` for 32bit Windows binaries (X86). 182The other two options are `VC-WIN64I` (Intel IA64, Itanium) and 183`VC-CE` (Windows CE) are rather uncommon nowadays. 184 185Installing OpenSSL 186------------------ 187 188The following commands will install OpenSSL to a default system location. 189 190**Danger Zone:** even if you are impatient, please read the following two 191paragraphs carefully before you install OpenSSL. 192 193For security reasons the default system location is by default not writable 194for unprivileged users. So for the final installation step administrative 195privileges are required. The default system location and the procedure to 196obtain administrative privileges depends on the operating system. 197It is recommended to compile and test OpenSSL with normal user privileges 198and use administrative privileges only for the final installation step. 199 200On some platforms OpenSSL is preinstalled as part of the Operating System. 201In this case it is highly recommended not to overwrite the system versions, 202because other applications or libraries might depend on it. 203To avoid breaking other applications, install your copy of OpenSSL to a 204[different location](#installing-to-a-different-location) which is not in 205the global search path for system libraries. 206 207Finally, if you plan on using the FIPS module, you need to read the 208[Post-installation Notes](#post-installation-notes) further down. 209 210### Unix / Linux / macOS 211 212Depending on your distribution, you need to run the following command as 213root user or prepend `sudo` to the command: 214 215 $ make install 216 217By default, OpenSSL will be installed to 218 219 /usr/local 220 221More precisely, the files will be installed into the subdirectories 222 223 /usr/local/bin 224 /usr/local/lib 225 /usr/local/include 226 ... 227 228depending on the file type, as it is custom on Unix-like operating systems. 229 230### OpenVMS 231 232Use the following command to install OpenSSL. 233 234 $ mms install 235 236By default, OpenSSL will be installed to 237 238 SYS$COMMON:[OPENSSL] 239 240### Windows 241 242If you are using Visual Studio, open the Developer Command Prompt _elevated_ 243and issue the following command. 244 245 $ nmake install 246 247The easiest way to elevate the Command Prompt is to press and hold down 248the both the `<CTRL>` and `<SHIFT>` key while clicking the menu item in the 249task menu. 250 251The default installation location is 252 253 C:\Program Files\OpenSSL 254 255for native binaries, or 256 257 C:\Program Files (x86)\OpenSSL 258 259for 32bit binaries on 64bit Windows (WOW64). 260 261#### Installing to a different location 262 263To install OpenSSL to a different location (for example into your home 264directory for testing purposes) run `Configure` as shown in the following 265examples. 266 267The options `--prefix` and `--openssldir` are explained in further detail in 268[Directories](#directories) below, and the values used here are mere examples. 269 270On Unix: 271 272 $ ./Configure --prefix=/opt/openssl --openssldir=/usr/local/ssl 273 274On OpenVMS: 275 276 $ perl Configure --prefix=PROGRAM:[INSTALLS] --openssldir=SYS$MANAGER:[OPENSSL] 277 278Note: if you do add options to the configuration command, please make sure 279you've read more than just this Quick Start, such as relevant `NOTES-*` files, 280the options outline below, as configuration options may change the outcome 281in otherwise unexpected ways. 282 283Configuration Options 284===================== 285 286There are several options to `./Configure` to customize the build (note that 287for Windows, the defaults for `--prefix` and `--openssldir` depend on what 288configuration is used and what Windows implementation OpenSSL is built on. 289For more information, see the [Notes for Windows platforms](NOTES-WINDOWS.md). 290 291API Level 292--------- 293 294 --api=x.y[.z] 295 296Build the OpenSSL libraries to support the API for the specified version. 297If [no-deprecated](#no-deprecated) is also given, don't build with support 298for deprecated APIs in or below the specified version number. For example, 299adding 300 301 --api=1.1.0 no-deprecated 302 303will remove support for all APIs that were deprecated in OpenSSL version 3041.1.0 or below. This is a rather specialized option for developers. 305If you just intend to remove all deprecated APIs up to the current version 306entirely, just specify [no-deprecated](#no-deprecated). 307If `--api` isn't given, it defaults to the current (minor) OpenSSL version. 308 309Cross Compile Prefix 310-------------------- 311 312 --cross-compile-prefix=<PREFIX> 313 314The `<PREFIX>` to include in front of commands for your toolchain. 315 316It is likely to have to end with dash, e.g. `a-b-c-` would invoke GNU compiler 317as `a-b-c-gcc`, etc. Unfortunately cross-compiling is too case-specific to put 318together one-size-fits-all instructions. You might have to pass more flags or 319set up environment variables to actually make it work. Android and iOS cases 320are discussed in corresponding `Configurations/15-*.conf` files. But there are 321cases when this option alone is sufficient. For example to build the mingw64 322target on Linux `--cross-compile-prefix=x86_64-w64-mingw32-` works. Naturally 323provided that mingw packages are installed. Today Debian and Ubuntu users 324have option to install a number of prepackaged cross-compilers along with 325corresponding run-time and development packages for "alien" hardware. To give 326another example `--cross-compile-prefix=mipsel-linux-gnu-` suffices in such 327case. 328 329For cross compilation, you must [configure manually](#manual-configuration). 330Also, note that `--openssldir` refers to target's file system, not one you are 331building on. 332 333Build Type 334---------- 335 336 --debug 337 338Build OpenSSL with debugging symbols and zero optimization level. 339 340 --release 341 342Build OpenSSL without debugging symbols. This is the default. 343 344Directories 345----------- 346 347### libdir 348 349 --libdir=DIR 350 351The name of the directory under the top of the installation directory tree 352(see the `--prefix` option) where libraries will be installed. By default 353this is `lib`. Note that on Windows only static libraries (`*.lib`) will 354be stored in this location. Shared libraries (`*.dll`) will always be 355installed to the `bin` directory. 356 357Some build targets have a multilib postfix set in the build configuration. 358For these targets the default libdir is `lib<multilib-postfix>`. Please use 359`--libdir=lib` to override the libdir if adding the postfix is undesirable. 360 361### openssldir 362 363 --openssldir=DIR 364 365Directory for OpenSSL configuration files, and also the default certificate 366and key store. Defaults are: 367 368 Unix: /usr/local/ssl 369 Windows: C:\Program Files\Common Files\SSL 370 OpenVMS: SYS$COMMON:[OPENSSL-COMMON] 371 372For 32bit Windows applications on Windows 64bit (WOW64), always replace 373`C:\Program Files` by `C:\Program Files (x86)`. 374 375### prefix 376 377 --prefix=DIR 378 379The top of the installation directory tree. Defaults are: 380 381 Unix: /usr/local 382 Windows: C:\Program Files\OpenSSL 383 OpenVMS: SYS$COMMON:[OPENSSL] 384 385Compiler Warnings 386----------------- 387 388 --strict-warnings 389 390This is a developer flag that switches on various compiler options recommended 391for OpenSSL development. It only works when using gcc or clang as the compiler. 392If you are developing a patch for OpenSSL then it is recommended that you use 393this option where possible. 394 395ZLib Flags 396---------- 397 398### with-zlib-include 399 400 --with-zlib-include=DIR 401 402The directory for the location of the zlib include file. This option is only 403necessary if [zlib](#zlib) is used and the include file is not 404already on the system include path. 405 406### with-zlib-lib 407 408 --with-zlib-lib=LIB 409 410**On Unix**: this is the directory containing the zlib library. 411If not provided the system library path will be used. 412 413**On Windows:** this is the filename of the zlib library (with or 414without a path). This flag must be provided if the 415[zlib-dynamic](#zlib-dynamic) option is not also used. If `zlib-dynamic` is used 416then this flag is optional and defaults to `ZLIB1` if not provided. 417 418**On VMS:** this is the filename of the zlib library (with or without a path). 419This flag is optional and if not provided then `GNV$LIBZSHR`, `GNV$LIBZSHR32` 420or `GNV$LIBZSHR64` is used by default depending on the pointer size chosen. 421 422Seeding the Random Generator 423---------------------------- 424 425 --with-rand-seed=seed1[,seed2,...] 426 427A comma separated list of seeding methods which will be tried by OpenSSL 428in order to obtain random input (a.k.a "entropy") for seeding its 429cryptographically secure random number generator (CSPRNG). 430The current seeding methods are: 431 432### os 433 434Use a trusted operating system entropy source. 435This is the default method if such an entropy source exists. 436 437### getrandom 438 439Use the [getrandom(2)][man-getrandom] or equivalent system call. 440 441[man-getrandom]: http://man7.org/linux/man-pages/man2/getrandom.2.html 442 443### devrandom 444 445Use the first device from the `DEVRANDOM` list which can be opened to read 446random bytes. The `DEVRANDOM` preprocessor constant expands to 447 448 "/dev/urandom","/dev/random","/dev/srandom" 449 450on most unix-ish operating systems. 451 452### egd 453 454Check for an entropy generating daemon. 455This source is ignored by the FIPS provider. 456 457### rdcpu 458 459Use the `RDSEED` or `RDRAND` command if provided by the CPU. 460 461### librandom 462 463Use librandom (not implemented yet). 464This source is ignored by the FIPS provider. 465 466### none 467 468Disable automatic seeding. This is the default on some operating systems where 469no suitable entropy source exists, or no support for it is implemented yet. 470This option is ignored by the FIPS provider. 471 472For more information, see the section [Notes on random number generation][rng] 473at the end of this document. 474 475[rng]: #notes-on-random-number-generation 476 477Setting the FIPS HMAC key 478------------------------- 479 480 --fips-key=value 481 482As part of its self-test validation, the FIPS module must verify itself 483by performing a SHA-256 HMAC computation on itself. The default key is 484the SHA256 value of "the holy handgrenade of antioch" and is sufficient 485for meeting the FIPS requirements. 486 487To change the key to a different value, use this flag. The value should 488be a hex string no more than 64 characters. 489 490Enable and Disable Features 491--------------------------- 492 493Feature options always come in pairs, an option to enable feature 494`xxxx`, and an option to disable it: 495 496 [ enable-xxxx | no-xxxx ] 497 498Whether a feature is enabled or disabled by default, depends on the feature. 499In the following list, always the non-default variant is documented: if 500feature `xxxx` is disabled by default then `enable-xxxx` is documented and 501if feature `xxxx` is enabled by default then `no-xxxx` is documented. 502 503### no-afalgeng 504 505Don't build the AFALG engine. 506 507This option will be forced on a platform that does not support AFALG. 508 509### enable-ktls 510 511Build with Kernel TLS support. 512 513This option will enable the use of the Kernel TLS data-path, which can improve 514performance and allow for the use of sendfile and splice system calls on 515TLS sockets. The Kernel may use TLS accelerators if any are available on the 516system. This option will be forced off on systems that do not support the 517Kernel TLS data-path. 518 519### enable-asan 520 521Build with the Address sanitiser. 522 523This is a developer option only. It may not work on all platforms and should 524never be used in production environments. It will only work when used with 525gcc or clang and should be used in conjunction with the [no-shared](#no-shared) 526option. 527 528### enable-acvp-tests 529 530Build support for Automated Cryptographic Validation Protocol (ACVP) 531tests. 532 533This is required for FIPS validation purposes. Certain ACVP tests require 534access to algorithm internals that are not normally accessible. 535Additional information related to ACVP can be found at 536<https://github.com/usnistgov/ACVP>. 537 538### no-asm 539 540Do not use assembler code. 541 542This should be viewed as debugging/troubleshooting option rather than for 543production use. On some platforms a small amount of assembler code may still 544be used even with this option. 545 546### no-async 547 548Do not build support for async operations. 549 550### no-autoalginit 551 552Don't automatically load all supported ciphers and digests. 553 554Typically OpenSSL will make available all of its supported ciphers and digests. 555For a statically linked application this may be undesirable if small executable 556size is an objective. This only affects libcrypto. Ciphers and digests will 557have to be loaded manually using `EVP_add_cipher()` and `EVP_add_digest()` 558if this option is used. This option will force a non-shared build. 559 560### no-autoerrinit 561 562Don't automatically load all libcrypto/libssl error strings. 563 564Typically OpenSSL will automatically load human readable error strings. For a 565statically linked application this may be undesirable if small executable size 566is an objective. 567 568### no-autoload-config 569 570Don't automatically load the default `openssl.cnf` file. 571 572Typically OpenSSL will automatically load a system config file which configures 573default SSL options. 574 575### enable-buildtest-c++ 576 577While testing, generate C++ buildtest files that simply check that the public 578OpenSSL header files are usable standalone with C++. 579 580Enabling this option demands extra care. For any compiler flag given directly 581as configuration option, you must ensure that it's valid for both the C and 582the C++ compiler. If not, the C++ build test will most likely break. As an 583alternative, you can use the language specific variables, `CFLAGS` and `CXXFLAGS`. 584 585### --banner=text 586 587Use the specified text instead of the default banner at the end of 588configuration. 589 590### --w 591 592On platforms where the choice of 32-bit or 64-bit architecture 593is not explicitly specified, `Configure` will print a warning 594message and wait for a few seconds to let you interrupt the 595configuration. Using this flag skips the wait. 596 597### no-bulk 598 599Build only some minimal set of features. 600This is a developer option used internally for CI build tests of the project. 601 602### no-cached-fetch 603 604Never cache algorithms when they are fetched from a provider. Normally, a 605provider indicates if the algorithms it supplies can be cached or not. Using 606this option will reduce run-time memory usage but it also introduces a 607significant performance penalty. This option is primarily designed to help 608with detecting incorrect reference counting. 609 610### no-capieng 611 612Don't build the CAPI engine. 613 614This option will be forced if on a platform that does not support CAPI. 615 616### no-cmp 617 618Don't build support for Certificate Management Protocol (CMP) 619and Certificate Request Message Format (CRMF). 620 621### no-cms 622 623Don't build support for Cryptographic Message Syntax (CMS). 624 625### no-comp 626 627Don't build support for SSL/TLS compression. 628 629If this option is enabled (the default), then compression will only work if 630the zlib or `zlib-dynamic` options are also chosen. 631 632### enable-crypto-mdebug 633 634This now only enables the `failed-malloc` feature. 635 636### enable-crypto-mdebug-backtrace 637 638This is a no-op; the project uses the compiler's address/leak sanitizer instead. 639 640### no-ct 641 642Don't build support for Certificate Transparency (CT). 643 644### no-deprecated 645 646Don't build with support for deprecated APIs up until and including the version 647given with `--api` (or the current version, if `--api` wasn't specified). 648 649### no-dgram 650 651Don't build support for datagram based BIOs. 652 653Selecting this option will also force the disabling of DTLS. 654 655### no-dso 656 657Don't build support for loading Dynamic Shared Objects (DSO) 658 659### enable-devcryptoeng 660 661Build the `/dev/crypto` engine. 662 663This option is automatically selected on the BSD platform, in which case it can 664be disabled with `no-devcryptoeng`. 665 666### no-dynamic-engine 667 668Don't build the dynamically loaded engines. 669 670This only has an effect in a shared build. 671 672### no-ec 673 674Don't build support for Elliptic Curves. 675 676### no-ec2m 677 678Don't build support for binary Elliptic Curves 679 680### enable-ec_nistp_64_gcc_128 681 682Enable support for optimised implementations of some commonly used NIST 683elliptic curves. 684 685This option is only supported on platforms: 686 687 - with little-endian storage of non-byte types 688 - that tolerate misaligned memory references 689 - where the compiler: 690 - supports the non-standard type `__uint128_t` 691 - defines the built-in macro `__SIZEOF_INT128__` 692 693### enable-egd 694 695Build support for gathering entropy from the Entropy Gathering Daemon (EGD). 696 697### no-engine 698 699Don't build support for loading engines. 700 701### no-err 702 703Don't compile in any error strings. 704 705### enable-external-tests 706 707Enable building of integration with external test suites. 708 709This is a developer option and may not work on all platforms. The following 710external test suites are currently supported: 711 712 - GOST engine test suite 713 - Python PYCA/Cryptography test suite 714 - krb5 test suite 715 716See the file [test/README-external.md](test/README-external.md) 717for further details. 718 719### no-filenames 720 721Don't compile in filename and line number information (e.g. for errors and 722memory allocation). 723 724### enable-fips 725 726Build (and install) the FIPS provider 727 728### no-fips-securitychecks 729 730Don't perform FIPS module run-time checks related to enforcement of security 731parameters such as minimum security strength of keys. 732 733### enable-fuzz-libfuzzer, enable-fuzz-afl 734 735Build with support for fuzzing using either libfuzzer or AFL. 736 737These are developer options only. They may not work on all platforms and 738should never be used in production environments. 739 740See the file [fuzz/README.md](fuzz/README.md) for further details. 741 742### no-gost 743 744Don't build support for GOST based ciphersuites. 745 746Note that if this feature is enabled then GOST ciphersuites are only available 747if the GOST algorithms are also available through loading an externally supplied 748engine. 749 750### no-legacy 751 752Don't build the legacy provider. 753 754Disabling this also disables the legacy algorithms: MD2 (already disabled by default). 755 756### no-makedepend 757 758Don't generate dependencies. 759 760### no-module 761 762Don't build any dynamically loadable engines. 763 764This also implies `no-dynamic-engine`. 765 766### no-multiblock 767 768Don't build support for writing multiple records in one go in libssl 769 770Note: this is a different capability to the pipelining functionality. 771 772### no-nextprotoneg 773 774Don't build support for the Next Protocol Negotiation (NPN) TLS extension. 775 776### no-ocsp 777 778Don't build support for Online Certificate Status Protocol (OCSP). 779 780### no-padlockeng 781 782Don't build the padlock engine. 783 784### no-hw-padlock 785 786As synonym for `no-padlockeng`. Deprecated and should not be used. 787 788### no-pic 789 790Don't build with support for Position Independent Code. 791 792### no-pinshared 793 794Don't pin the shared libraries. 795 796By default OpenSSL will attempt to stay in memory until the process exits. 797This is so that libcrypto and libssl can be properly cleaned up automatically 798via an `atexit()` handler. The handler is registered by libcrypto and cleans 799up both libraries. On some platforms the `atexit()` handler will run on unload of 800libcrypto (if it has been dynamically loaded) rather than at process exit. This 801option can be used to stop OpenSSL from attempting to stay in memory until the 802process exits. This could lead to crashes if either libcrypto or libssl have 803already been unloaded at the point that the atexit handler is invoked, e.g. on a 804platform which calls `atexit()` on unload of the library, and libssl is unloaded 805before libcrypto then a crash is likely to happen. Applications can suppress 806running of the `atexit()` handler at run time by using the 807`OPENSSL_INIT_NO_ATEXIT` option to `OPENSSL_init_crypto()`. 808See the man page for it for further details. 809 810### no-posix-io 811 812Don't use POSIX IO capabilities. 813 814### no-psk 815 816Don't build support for Pre-Shared Key based ciphersuites. 817 818### no-quic 819 820Don't build support for QUIC API from BoringSSL. 821 822### no-rdrand 823 824Don't use hardware RDRAND capabilities. 825 826### no-rfc3779 827 828Don't build support for RFC3779, "X.509 Extensions for IP Addresses and 829AS Identifiers". 830 831### sctp 832 833Build support for Stream Control Transmission Protocol (SCTP). 834 835### no-shared 836 837Do not create shared libraries, only static ones. 838 839See [Notes on shared libraries](#notes-on-shared-libraries) below. 840 841### no-sock 842 843Don't build support for socket BIOs. 844 845### no-srp 846 847Don't build support for Secure Remote Password (SRP) protocol or 848SRP based ciphersuites. 849 850### no-srtp 851 852Don't build Secure Real-Time Transport Protocol (SRTP) support. 853 854### no-sse2 855 856Exclude SSE2 code paths from 32-bit x86 assembly modules. 857 858Normally SSE2 extension is detected at run-time, but the decision whether or not 859the machine code will be executed is taken solely on CPU capability vector. This 860means that if you happen to run OS kernel which does not support SSE2 extension 861on Intel P4 processor, then your application might be exposed to "illegal 862instruction" exception. There might be a way to enable support in kernel, e.g. 863FreeBSD kernel can be compiled with `CPU_ENABLE_SSE`, and there is a way to 864disengage SSE2 code paths upon application start-up, but if you aim for wider 865"audience" running such kernel, consider `no-sse2`. Both the `386` and `no-asm` 866options imply `no-sse2`. 867 868### no-ssl-trace 869 870Don't build with SSL Trace capabilities. 871 872This removes the `-trace` option from `s_client` and `s_server`, and omits the 873`SSL_trace()` function from libssl. 874 875Disabling `ssl-trace` may provide a small reduction in libssl binary size. 876 877### no-static-engine 878 879Don't build the statically linked engines. 880 881This only has an impact when not built "shared". 882 883### no-stdio 884 885Don't use anything from the C header file `stdio.h` that makes use of the `FILE` 886type. Only libcrypto and libssl can be built in this way. Using this option will 887suppress building the command line applications. Additionally, since the OpenSSL 888tests also use the command line applications, the tests will also be skipped. 889 890### no-tests 891 892Don't build test programs or run any tests. 893 894### no-threads 895 896Don't build with support for multi-threaded applications. 897 898### threads 899 900Build with support for multi-threaded applications. Most platforms will enable 901this by default. However, if on a platform where this is not the case then this 902will usually require additional system-dependent options! 903 904See [Notes on multi-threading](#notes-on-multi-threading) below. 905 906### enable-trace 907 908Build with support for the integrated tracing api. 909 910See manual pages OSSL_trace_set_channel(3) and OSSL_trace_enabled(3) for details. 911 912### no-ts 913 914Don't build Time Stamping (TS) Authority support. 915 916### enable-ubsan 917 918Build with the Undefined Behaviour sanitiser (UBSAN). 919 920This is a developer option only. It may not work on all platforms and should 921never be used in production environments. It will only work when used with 922gcc or clang and should be used in conjunction with the `-DPEDANTIC` option 923(or the `--strict-warnings` option). 924 925### no-ui-console 926 927Don't build with the User Interface (UI) console method 928 929The User Interface console method enables text based console prompts. 930 931### enable-unit-test 932 933Enable additional unit test APIs. 934 935This should not typically be used in production deployments. 936 937### no-uplink 938 939Don't build support for UPLINK interface. 940 941### enable-weak-ssl-ciphers 942 943Build support for SSL/TLS ciphers that are considered "weak" 944 945Enabling this includes for example the RC4 based ciphersuites. 946 947### zlib 948 949Build with support for zlib compression/decompression. 950 951### zlib-dynamic 952 953Like the zlib option, but has OpenSSL load the zlib library dynamically 954when needed. 955 956This is only supported on systems where loading of shared libraries is supported. 957 958### 386 959 960In 32-bit x86 builds, use the 80386 instruction set only in assembly modules 961 962The default x86 code is more efficient, but requires at least an 486 processor. 963Note: This doesn't affect compiler generated code, so this option needs to be 964accompanied by a corresponding compiler-specific option. 965 966### no-{protocol} 967 968 no-{ssl|ssl3|tls|tls1|tls1_1|tls1_2|tls1_3|dtls|dtls1|dtls1_2} 969 970Don't build support for negotiating the specified SSL/TLS protocol. 971 972If `no-tls` is selected then all of `tls1`, `tls1_1`, `tls1_2` and `tls1_3` 973are disabled. 974Similarly `no-dtls` will disable `dtls1` and `dtls1_2`. The `no-ssl` option is 975synonymous with `no-ssl3`. Note this only affects version negotiation. 976OpenSSL will still provide the methods for applications to explicitly select 977the individual protocol versions. 978 979### no-{protocol}-method 980 981 no-{ssl|ssl3|tls|tls1|tls1_1|tls1_2|tls1_3|dtls|dtls1|dtls1_2}-method 982 983Analogous to `no-{protocol}` but in addition do not build the methods for 984applications to explicitly select individual protocol versions. Note that there 985is no `no-tls1_3-method` option because there is no application method for 986TLSv1.3. 987 988Using individual protocol methods directly is deprecated. Applications should 989use `TLS_method()` instead. 990 991### enable-{algorithm} 992 993 enable-{md2|rc5} 994 995Build with support for the specified algorithm. 996 997### no-{algorithm} 998 999 no-{aria|bf|blake2|camellia|cast|chacha|cmac| 1000 des|dh|dsa|ecdh|ecdsa|idea|md4|mdc2|ocb| 1001 poly1305|rc2|rc4|rmd160|scrypt|seed| 1002 siphash|siv|sm2|sm3|sm4|whirlpool} 1003 1004Build without support for the specified algorithm. 1005 1006The `ripemd` algorithm is deprecated and if used is synonymous with `rmd160`. 1007 1008### Compiler-specific options 1009 1010 -Dxxx, -Ixxx, -Wp, -lxxx, -Lxxx, -Wl, -rpath, -R, -framework, -static 1011 1012These system specific options will be recognised and passed through to the 1013compiler to allow you to define preprocessor symbols, specify additional 1014libraries, library directories or other compiler options. It might be worth 1015noting that some compilers generate code specifically for processor the 1016compiler currently executes on. This is not necessarily what you might have 1017in mind, since it might be unsuitable for execution on other, typically older, 1018processor. Consult your compiler documentation. 1019 1020Take note of the [Environment Variables](#environment-variables) documentation 1021below and how these flags interact with those variables. 1022 1023 -xxx, +xxx, /xxx 1024 1025Additional options that are not otherwise recognised are passed through as 1026they are to the compiler as well. Unix-style options beginning with a 1027`-` or `+` and Windows-style options beginning with a `/` are recognized. 1028Again, consult your compiler documentation. 1029 1030If the option contains arguments separated by spaces, then the URL-style 1031notation `%20` can be used for the space character in order to avoid having 1032to quote the option. For example, `-opt%20arg` gets expanded to `-opt arg`. 1033In fact, any ASCII character can be encoded as %xx using its hexadecimal 1034encoding. 1035 1036Take note of the [Environment Variables](#environment-variables) documentation 1037below and how these flags interact with those variables. 1038 1039### Environment Variables 1040 1041 VAR=value 1042 1043Assign the given value to the environment variable `VAR` for `Configure`. 1044 1045These work just like normal environment variable assignments, but are supported 1046on all platforms and are confined to the configuration scripts only. 1047These assignments override the corresponding value in the inherited environment, 1048if there is one. 1049 1050The following variables are used as "`make` variables" and can be used as an 1051alternative to giving preprocessor, compiler and linker options directly as 1052configuration. The following variables are supported: 1053 1054 AR The static library archiver. 1055 ARFLAGS Flags for the static library archiver. 1056 AS The assembler compiler. 1057 ASFLAGS Flags for the assembler compiler. 1058 CC The C compiler. 1059 CFLAGS Flags for the C compiler. 1060 CXX The C++ compiler. 1061 CXXFLAGS Flags for the C++ compiler. 1062 CPP The C/C++ preprocessor. 1063 CPPFLAGS Flags for the C/C++ preprocessor. 1064 CPPDEFINES List of CPP macro definitions, separated 1065 by a platform specific character (':' or 1066 space for Unix, ';' for Windows, ',' for 1067 VMS). This can be used instead of using 1068 -D (or what corresponds to that on your 1069 compiler) in CPPFLAGS. 1070 CPPINCLUDES List of CPP inclusion directories, separated 1071 the same way as for CPPDEFINES. This can 1072 be used instead of -I (or what corresponds 1073 to that on your compiler) in CPPFLAGS. 1074 HASHBANGPERL Perl invocation to be inserted after '#!' 1075 in public perl scripts (only relevant on 1076 Unix). 1077 LD The program linker (not used on Unix, $(CC) 1078 is used there). 1079 LDFLAGS Flags for the shared library, DSO and 1080 program linker. 1081 LDLIBS Extra libraries to use when linking. 1082 Takes the form of a space separated list 1083 of library specifications on Unix and 1084 Windows, and as a comma separated list of 1085 libraries on VMS. 1086 RANLIB The library archive indexer. 1087 RC The Windows resource compiler. 1088 RCFLAGS Flags for the Windows resource compiler. 1089 RM The command to remove files and directories. 1090 1091These cannot be mixed with compiling/linking flags given on the command line. 1092In other words, something like this isn't permitted. 1093 1094 $ ./Configure -DFOO CPPFLAGS=-DBAR -DCOOKIE 1095 1096Backward compatibility note: 1097 1098To be compatible with older configuration scripts, the environment variables 1099are ignored if compiling/linking flags are given on the command line, except 1100for the following: 1101 1102 AR, CC, CXX, CROSS_COMPILE, HASHBANGPERL, PERL, RANLIB, RC, and WINDRES 1103 1104For example, the following command will not see `-DBAR`: 1105 1106 $ CPPFLAGS=-DBAR ./Configure -DCOOKIE 1107 1108However, the following will see both set variables: 1109 1110 $ CC=gcc CROSS_COMPILE=x86_64-w64-mingw32- ./Configure -DCOOKIE 1111 1112If `CC` is set, it is advisable to also set `CXX` to ensure both the C and C++ 1113compiler are in the same "family". This becomes relevant with 1114`enable-external-tests` and `enable-buildtest-c++`. 1115 1116### Reconfigure 1117 1118 reconf 1119 reconfigure 1120 1121Reconfigure from earlier data. 1122 1123This fetches the previous command line options and environment from data 1124saved in `configdata.pm` and runs the configuration process again, using 1125these options and environment. Note: NO other option is permitted together 1126with `reconf`. Note: The original configuration saves away values for ALL 1127environment variables that were used, and if they weren't defined, they are 1128still saved away with information that they weren't originally defined. 1129This information takes precedence over environment variables that are 1130defined when reconfiguring. 1131 1132Displaying configuration data 1133----------------------------- 1134 1135The configuration script itself will say very little, and finishes by 1136creating `configdata.pm`. This perl module can be loaded by other scripts 1137to find all the configuration data, and it can also be used as a script to 1138display all sorts of configuration data in a human readable form. 1139 1140For more information, please do: 1141 1142 $ ./configdata.pm --help # Unix 1143 1144or 1145 1146 $ perl configdata.pm --help # Windows and VMS 1147 1148Installation Steps in Detail 1149============================ 1150 1151Configure OpenSSL 1152----------------- 1153 1154### Automatic Configuration 1155 1156In previous version, the `config` script determined the platform type and 1157compiler and then called `Configure`. Starting with this release, they are 1158the same. 1159 1160#### Unix / Linux / macOS 1161 1162 $ ./Configure [[ options ]] 1163 1164#### OpenVMS 1165 1166 $ perl Configure [[ options ]] 1167 1168#### Windows 1169 1170 $ perl Configure [[ options ]] 1171 1172### Manual Configuration 1173 1174OpenSSL knows about a range of different operating system, hardware and 1175compiler combinations. To see the ones it knows about, run 1176 1177 $ ./Configure LIST # Unix 1178 1179or 1180 1181 $ perl Configure LIST # All other platforms 1182 1183For the remainder of this text, the Unix form will be used in all examples. 1184Please use the appropriate form for your platform. 1185 1186Pick a suitable name from the list that matches your system. For most 1187operating systems there is a choice between using cc or gcc. 1188When you have identified your system (and if necessary compiler) use this 1189name as the argument to `Configure`. For example, a `linux-elf` user would 1190run: 1191 1192 $ ./Configure linux-elf [[ options ]] 1193 1194### Creating your own Configuration 1195 1196If your system isn't listed, you will have to create a configuration 1197file named `Configurations/{{ something }}.conf` and add the correct 1198configuration for your system. See the available configs as examples 1199and read [Configurations/README.md](Configurations/README.md) and 1200[Configurations/README-design.md](Configurations/README-design.md) 1201for more information. 1202 1203The generic configurations `cc` or `gcc` should usually work on 32 bit 1204Unix-like systems. 1205 1206`Configure` creates a build file (`Makefile` on Unix, `makefile` on Windows 1207and `descrip.mms` on OpenVMS) from a suitable template in `Configurations/`, 1208and defines various macros in `include/openssl/configuration.h` (generated 1209from `include/openssl/configuration.h.in`. 1210 1211### Out of Tree Builds 1212 1213OpenSSL can be configured to build in a build directory separate from the 1214source code directory. It's done by placing yourself in some other 1215directory and invoking the configuration commands from there. 1216 1217#### Unix example 1218 1219 $ mkdir /var/tmp/openssl-build 1220 $ cd /var/tmp/openssl-build 1221 $ /PATH/TO/OPENSSL/SOURCE/Configure [[ options ]] 1222 1223#### OpenVMS example 1224 1225 $ set default sys$login: 1226 $ create/dir [.tmp.openssl-build] 1227 $ set default [.tmp.openssl-build] 1228 $ perl D:[PATH.TO.OPENSSL.SOURCE]Configure [[ options ]] 1229 1230#### Windows example 1231 1232 $ C: 1233 $ mkdir \temp-openssl 1234 $ cd \temp-openssl 1235 $ perl d:\PATH\TO\OPENSSL\SOURCE\Configure [[ options ]] 1236 1237Paths can be relative just as well as absolute. `Configure` will do its best 1238to translate them to relative paths whenever possible. 1239 1240Build OpenSSL 1241------------- 1242 1243Build OpenSSL by running: 1244 1245 $ make # Unix 1246 $ mms ! (or mmk) OpenVMS 1247 $ nmake # Windows 1248 1249This will build the OpenSSL libraries (`libcrypto.a` and `libssl.a` on 1250Unix, corresponding on other platforms) and the OpenSSL binary 1251(`openssl`). The libraries will be built in the top-level directory, 1252and the binary will be in the `apps/` subdirectory. 1253 1254If the build fails, take a look at the [Build Failures](#build-failures) 1255subsection of the [Troubleshooting](#troubleshooting) section. 1256 1257Test OpenSSL 1258------------ 1259 1260After a successful build, and before installing, the libraries should 1261be tested. Run: 1262 1263 $ make test # Unix 1264 $ mms test ! OpenVMS 1265 $ nmake test # Windows 1266 1267**Warning:** you MUST run the tests from an unprivileged account (or disable 1268your privileges temporarily if your platform allows it). 1269 1270See [test/README.md](test/README.md) for further details how run tests. 1271 1272See [test/README-dev.md](test/README-dev.md) for guidelines on adding tests. 1273 1274Install OpenSSL 1275--------------- 1276 1277If everything tests ok, install OpenSSL with 1278 1279 $ make install # Unix 1280 $ mms install ! OpenVMS 1281 $ nmake install # Windows 1282 1283Note that in order to perform the install step above you need to have 1284appropriate permissions to write to the installation directory. 1285 1286The above commands will install all the software components in this 1287directory tree under `<PREFIX>` (the directory given with `--prefix` or 1288its default): 1289 1290### Unix / Linux / macOS 1291 1292 bin/ Contains the openssl binary and a few other 1293 utility scripts. 1294 include/openssl 1295 Contains the header files needed if you want 1296 to build your own programs that use libcrypto 1297 or libssl. 1298 lib Contains the OpenSSL library files. 1299 lib/engines Contains the OpenSSL dynamically loadable engines. 1300 1301 share/man/man1 Contains the OpenSSL command line man-pages. 1302 share/man/man3 Contains the OpenSSL library calls man-pages. 1303 share/man/man5 Contains the OpenSSL configuration format man-pages. 1304 share/man/man7 Contains the OpenSSL other misc man-pages. 1305 1306 share/doc/openssl/html/man1 1307 share/doc/openssl/html/man3 1308 share/doc/openssl/html/man5 1309 share/doc/openssl/html/man7 1310 Contains the HTML rendition of the man-pages. 1311 1312### OpenVMS 1313 1314'arch' is replaced with the architecture name, `ALPHA` or `IA64`, 1315'sover' is replaced with the shared library version (`0101` for 1.1), and 1316'pz' is replaced with the pointer size OpenSSL was built with: 1317 1318 [.EXE.'arch'] Contains the openssl binary. 1319 [.EXE] Contains a few utility scripts. 1320 [.include.openssl] 1321 Contains the header files needed if you want 1322 to build your own programs that use libcrypto 1323 or libssl. 1324 [.LIB.'arch'] Contains the OpenSSL library files. 1325 [.ENGINES'sover''pz'.'arch'] 1326 Contains the OpenSSL dynamically loadable engines. 1327 [.SYS$STARTUP] Contains startup, login and shutdown scripts. 1328 These define appropriate logical names and 1329 command symbols. 1330 [.SYSTEST] Contains the installation verification procedure. 1331 [.HTML] Contains the HTML rendition of the manual pages. 1332 1333### Additional Directories 1334 1335Additionally, install will add the following directories under 1336OPENSSLDIR (the directory given with `--openssldir` or its default) 1337for you convenience: 1338 1339 certs Initially empty, this is the default location 1340 for certificate files. 1341 private Initially empty, this is the default location 1342 for private key files. 1343 misc Various scripts. 1344 1345The installation directory should be appropriately protected to ensure 1346unprivileged users cannot make changes to OpenSSL binaries or files, or 1347install engines. If you already have a pre-installed version of OpenSSL as 1348part of your Operating System it is recommended that you do not overwrite 1349the system version and instead install to somewhere else. 1350 1351Package builders who want to configure the library for standard locations, 1352but have the package installed somewhere else so that it can easily be 1353packaged, can use 1354 1355 $ make DESTDIR=/tmp/package-root install # Unix 1356 $ mms/macro="DESTDIR=TMP:[PACKAGE-ROOT]" install ! OpenVMS 1357 1358The specified destination directory will be prepended to all installation 1359target paths. 1360 1361Compatibility issues with previous OpenSSL versions 1362--------------------------------------------------- 1363 1364### COMPILING existing applications 1365 1366Starting with version 1.1.0, OpenSSL hides a number of structures that were 1367previously open. This includes all internal libssl structures and a number 1368of EVP types. Accessor functions have been added to allow controlled access 1369to the structures' data. 1370 1371This means that some software needs to be rewritten to adapt to the new ways 1372of doing things. This often amounts to allocating an instance of a structure 1373explicitly where you could previously allocate them on the stack as automatic 1374variables, and using the provided accessor functions where you would previously 1375access a structure's field directly. 1376 1377Some APIs have changed as well. However, older APIs have been preserved when 1378possible. 1379 1380Post-installation Notes 1381----------------------- 1382 1383With the default OpenSSL installation comes a FIPS provider module, which 1384needs some post-installation attention, without which it will not be usable. 1385This involves using the following command: 1386 1387 $ openssl fipsinstall 1388 1389See the openssl-fipsinstall(1) manual for details and examples. 1390 1391Advanced Build Options 1392====================== 1393 1394Environment Variables 1395--------------------- 1396 1397A number of environment variables can be used to provide additional control 1398over the build process. Typically these should be defined prior to running 1399`Configure`. Not all environment variables are relevant to all platforms. 1400 1401 AR 1402 The name of the ar executable to use. 1403 1404 BUILDFILE 1405 Use a different build file name than the platform default 1406 ("Makefile" on Unix-like platforms, "makefile" on native Windows, 1407 "descrip.mms" on OpenVMS). This requires that there is a 1408 corresponding build file template. 1409 See [Configurations/README.md](Configurations/README.md) 1410 for further information. 1411 1412 CC 1413 The compiler to use. Configure will attempt to pick a default 1414 compiler for your platform but this choice can be overridden 1415 using this variable. Set it to the compiler executable you wish 1416 to use, e.g. gcc or clang. 1417 1418 CROSS_COMPILE 1419 This environment variable has the same meaning as for the 1420 "--cross-compile-prefix" Configure flag described above. If both 1421 are set then the Configure flag takes precedence. 1422 1423 HASHBANGPERL 1424 The command string for the Perl executable to insert in the 1425 #! line of perl scripts that will be publicly installed. 1426 Default: /usr/bin/env perl 1427 Note: the value of this variable is added to the same scripts 1428 on all platforms, but it's only relevant on Unix-like platforms. 1429 1430 KERNEL_BITS 1431 This can be the value `32` or `64` to specify the architecture 1432 when it is not "obvious" to the configuration. It should generally 1433 not be necessary to specify this environment variable. 1434 1435 NM 1436 The name of the nm executable to use. 1437 1438 OPENSSL_LOCAL_CONFIG_DIR 1439 OpenSSL comes with a database of information about how it 1440 should be built on different platforms as well as build file 1441 templates for those platforms. The database is comprised of 1442 ".conf" files in the Configurations directory. The build 1443 file templates reside there as well as ".tmpl" files. See the 1444 file [Configurations/README.md](Configurations/README.md) 1445 for further information about the format of ".conf" files 1446 as well as information on the ".tmpl" files. 1447 In addition to the standard ".conf" and ".tmpl" files, it is 1448 possible to create your own ".conf" and ".tmpl" files and 1449 store them locally, outside the OpenSSL source tree. 1450 This environment variable can be set to the directory where 1451 these files are held and will be considered by Configure 1452 before it looks in the standard directories. 1453 1454 PERL 1455 The name of the Perl executable to use when building OpenSSL. 1456 Only needed if builing should use a different Perl executable 1457 than what is used to run the Configure script. 1458 1459 RANLIB 1460 The name of the ranlib executable to use. 1461 1462 RC 1463 The name of the rc executable to use. The default will be as 1464 defined for the target platform in the ".conf" file. If not 1465 defined then "windres" will be used. The WINDRES environment 1466 variable is synonymous to this. If both are defined then RC 1467 takes precedence. 1468 1469 WINDRES 1470 See RC. 1471 1472Makefile Targets 1473---------------- 1474 1475The `Configure` script generates a Makefile in a format relevant to the specific 1476platform. The Makefiles provide a number of targets that can be used. Not all 1477targets may be available on all platforms. Only the most common targets are 1478described here. Examine the Makefiles themselves for the full list. 1479 1480 all 1481 The target to build all the software components and 1482 documentation. 1483 1484 build_sw 1485 Build all the software components. 1486 THIS IS THE DEFAULT TARGET. 1487 1488 build_docs 1489 Build all documentation components. 1490 1491 clean 1492 Remove all build artefacts and return the directory to a "clean" 1493 state. 1494 1495 depend 1496 Rebuild the dependencies in the Makefiles. This is a legacy 1497 option that no longer needs to be used since OpenSSL 1.1.0. 1498 1499 install 1500 Install all OpenSSL components. 1501 1502 install_sw 1503 Only install the OpenSSL software components. 1504 1505 install_docs 1506 Only install the OpenSSL documentation components. 1507 1508 install_man_docs 1509 Only install the OpenSSL man pages (Unix only). 1510 1511 install_html_docs 1512 Only install the OpenSSL HTML documentation. 1513 1514 install_fips 1515 Install the FIPS provider module configuration file. 1516 1517 list-tests 1518 Prints a list of all the self test names. 1519 1520 test 1521 Build and run the OpenSSL self tests. 1522 1523 uninstall 1524 Uninstall all OpenSSL components. 1525 1526 reconfigure 1527 reconf 1528 Re-run the configuration process, as exactly as the last time 1529 as possible. 1530 1531 update 1532 This is a developer option. If you are developing a patch for 1533 OpenSSL you may need to use this if you want to update 1534 automatically generated files; add new error codes or add new 1535 (or change the visibility of) public API functions. (Unix only). 1536 1537Running Selected Tests 1538---------------------- 1539 1540You can specify a set of tests to be performed 1541using the `make` variable `TESTS`. 1542 1543See the section [Running Selected Tests of 1544test/README.md](test/README.md#running-selected-tests). 1545 1546Troubleshooting 1547=============== 1548 1549Configuration Problems 1550---------------------- 1551 1552### Selecting the correct target 1553 1554The `./Configure` script tries hard to guess your operating system, but in some 1555cases it does not succeed. You will see a message like the following: 1556 1557 $ ./Configure 1558 Operating system: x86-whatever-minix 1559 This system (minix) is not supported. See file INSTALL.md for details. 1560 1561Even if the automatic target selection by the `./Configure` script fails, 1562chances are that you still might find a suitable target in the `Configurations` 1563directory, which you can supply to the `./Configure` command, 1564possibly after some adjustment. 1565 1566The `Configurations/` directory contains a lot of examples of such targets. 1567The main configuration file is [10-main.conf], which contains all targets that 1568are officially supported by the OpenSSL team. Other configuration files contain 1569targets contributed by other OpenSSL users. The list of targets can be found in 1570a Perl list `my %targets = ( ... )`. 1571 1572 my %targets = ( 1573 ... 1574 "target-name" => { 1575 inherit_from => [ "base-target" ], 1576 CC => "...", 1577 cflags => add("..."), 1578 asm_arch => '...', 1579 perlasm_scheme => "...", 1580 }, 1581 ... 1582 ) 1583 1584If you call `./Configure` without arguments, it will give you a list of all 1585known targets. Using `grep`, you can lookup the target definition in the 1586`Configurations/` directory. For example the `android-x86_64` can be found in 1587[Configurations/15-android.conf](Configurations/15-android.conf). 1588 1589The directory contains two README files, which explain the general syntax and 1590design of the configuration files. 1591 1592 - [Configurations/README.md](Configurations/README.md) 1593 - [Configurations/README-design.md](Configurations/README-design.md) 1594 1595If you need further help, try to search the [openssl-users] mailing list 1596or the [GitHub Issues] for existing solutions. If you don't find anything, 1597you can [raise an issue] to ask a question yourself. 1598 1599More about our support resources can be found in the [SUPPORT] file. 1600 1601### Configuration Errors 1602 1603If the `./Configure` or `./Configure` command fails with an error message, 1604read the error message carefully and try to figure out whether you made 1605a mistake (e.g., by providing a wrong option), or whether the script is 1606working incorrectly. If you think you encountered a bug, please 1607[raise an issue] on GitHub to file a bug report. 1608 1609Along with a short description of the bug, please provide the complete 1610configure command line and the relevant output including the error message. 1611 1612Note: To make the output readable, pleace add a 'code fence' (three backquotes 1613` ``` ` on a separate line) before and after your output: 1614 1615 ``` 1616 ./Configure [your arguments...] 1617 1618 [output...] 1619 1620 ``` 1621 1622Build Failures 1623-------------- 1624 1625If the build fails, look carefully at the output. Try to locate and understand 1626the error message. It might be that the compiler is already telling you 1627exactly what you need to do to fix your problem. 1628 1629There may be reasons for the failure that aren't problems in OpenSSL itself, 1630for example if the compiler reports missing standard or third party headers. 1631 1632If the build succeeded previously, but fails after a source or configuration 1633change, it might be helpful to clean the build tree before attempting another 1634build. Use this command: 1635 1636 $ make clean # Unix 1637 $ mms clean ! (or mmk) OpenVMS 1638 $ nmake clean # Windows 1639 1640Assembler error messages can sometimes be sidestepped by using the `no-asm` 1641configuration option. See also [notes](#notes-on-assembler-modules-compilation). 1642 1643Compiling parts of OpenSSL with gcc and others with the system compiler will 1644result in unresolved symbols on some systems. 1645 1646If you are still having problems, try to search the [openssl-users] mailing 1647list or the [GitHub Issues] for existing solutions. If you think you 1648encountered an OpenSSL bug, please [raise an issue] to file a bug report. 1649Please take the time to review the existing issues first; maybe the bug was 1650already reported or has already been fixed. 1651 1652Test Failures 1653------------- 1654 1655If some tests fail, look at the output. There may be reasons for the failure 1656that isn't a problem in OpenSSL itself (like an OS malfunction or a Perl issue). 1657 1658You may want increased verbosity, that can be accomplished as described in 1659section [Test Failures of test/README.md](test/README.md#test-failures). 1660 1661You may also want to selectively specify which test(s) to perform. This can be 1662done using the `make` variable `TESTS` as described in section [Running 1663Selected Tests of test/README.md](test/README.md#running-selected-tests). 1664 1665If you find a problem with OpenSSL itself, try removing any 1666compiler optimization flags from the `CFLAGS` line in the Makefile and 1667run `make clean; make` or corresponding. 1668 1669To report a bug please open an issue on GitHub, at 1670<https://github.com/openssl/openssl/issues>. 1671 1672Notes 1673===== 1674 1675Notes on multi-threading 1676------------------------ 1677 1678For some systems, the OpenSSL `Configure` script knows what compiler options 1679are needed to generate a library that is suitable for multi-threaded 1680applications. On these systems, support for multi-threading is enabled 1681by default; use the `no-threads` option to disable (this should never be 1682necessary). 1683 1684On other systems, to enable support for multi-threading, you will have 1685to specify at least two options: `threads`, and a system-dependent option. 1686(The latter is `-D_REENTRANT` on various systems.) The default in this 1687case, obviously, is not to include support for multi-threading (but 1688you can still use `no-threads` to suppress an annoying warning message 1689from the `Configure` script.) 1690 1691OpenSSL provides built-in support for two threading models: pthreads (found on 1692most UNIX/Linux systems), and Windows threads. No other threading models are 1693supported. If your platform does not provide pthreads or Windows threads then 1694you should use `Configure` with the `no-threads` option. 1695 1696For pthreads, all locks are non-recursive. In addition, in a debug build, 1697the mutex attribute `PTHREAD_MUTEX_ERRORCHECK` is used. If this is not 1698available on your platform, you might have to add 1699`-DOPENSSL_NO_MUTEX_ERRORCHECK` to your `Configure` invocation. 1700(On Linux `PTHREAD_MUTEX_ERRORCHECK` is an enum value, so a built-in 1701ifdef test cannot be used.) 1702 1703Notes on shared libraries 1704------------------------- 1705 1706For most systems the OpenSSL `Configure` script knows what is needed to 1707build shared libraries for libcrypto and libssl. On these systems 1708the shared libraries will be created by default. This can be suppressed and 1709only static libraries created by using the `no-shared` option. On systems 1710where OpenSSL does not know how to build shared libraries the `no-shared` 1711option will be forced and only static libraries will be created. 1712 1713Shared libraries are named a little differently on different platforms. 1714One way or another, they all have the major OpenSSL version number as 1715part of the file name, i.e. for OpenSSL 1.1.x, `1.1` is somehow part of 1716the name. 1717 1718On most POSIX platforms, shared libraries are named `libcrypto.so.1.1` 1719and `libssl.so.1.1`. 1720 1721on Cygwin, shared libraries are named `cygcrypto-1.1.dll` and `cygssl-1.1.dll` 1722with import libraries `libcrypto.dll.a` and `libssl.dll.a`. 1723 1724On Windows build with MSVC or using MingW, shared libraries are named 1725`libcrypto-1_1.dll` and `libssl-1_1.dll` for 32-bit Windows, 1726`libcrypto-1_1-x64.dll` and `libssl-1_1-x64.dll` for 64-bit x86_64 Windows, 1727and `libcrypto-1_1-ia64.dll` and `libssl-1_1-ia64.dll` for IA64 Windows. 1728With MSVC, the import libraries are named `libcrypto.lib` and `libssl.lib`, 1729while with MingW, they are named `libcrypto.dll.a` and `libssl.dll.a`. 1730 1731On VMS, shareable images (VMS speak for shared libraries) are named 1732`ossl$libcrypto0101_shr.exe` and `ossl$libssl0101_shr.exe`. However, when 1733OpenSSL is specifically built for 32-bit pointers, the shareable images 1734are named `ossl$libcrypto0101_shr32.exe` and `ossl$libssl0101_shr32.exe` 1735instead, and when built for 64-bit pointers, they are named 1736`ossl$libcrypto0101_shr64.exe` and `ossl$libssl0101_shr64.exe`. 1737 1738Notes on random number generation 1739--------------------------------- 1740 1741Availability of cryptographically secure random numbers is required for 1742secret key generation. OpenSSL provides several options to seed the 1743internal CSPRNG. If not properly seeded, the internal CSPRNG will refuse 1744to deliver random bytes and a "PRNG not seeded error" will occur. 1745 1746The seeding method can be configured using the `--with-rand-seed` option, 1747which can be used to specify a comma separated list of seed methods. 1748However, in most cases OpenSSL will choose a suitable default method, 1749so it is not necessary to explicitly provide this option. Note also 1750that not all methods are available on all platforms. The FIPS provider will 1751silently ignore seed sources that were not validated. 1752 1753I) On operating systems which provide a suitable randomness source (in 1754form of a system call or system device), OpenSSL will use the optimal 1755available method to seed the CSPRNG from the operating system's 1756randomness sources. This corresponds to the option `--with-rand-seed=os`. 1757 1758II) On systems without such a suitable randomness source, automatic seeding 1759and reseeding is disabled (`--with-rand-seed=none`) and it may be necessary 1760to install additional support software to obtain a random seed and reseed 1761the CSPRNG manually. Please check out the manual pages for `RAND_add()`, 1762`RAND_bytes()`, `RAND_egd()`, and the FAQ for more information. 1763 1764Notes on assembler modules compilation 1765-------------------------------------- 1766 1767Compilation of some code paths in assembler modules might depend on whether the 1768current assembler version supports certain ISA extensions or not. Code paths 1769that use the AES-NI, PCLMULQDQ, SSSE3, and SHA extensions are always assembled. 1770Apart from that, the minimum requirements for the assembler versions are shown 1771in the table below: 1772 1773| ISA extension | GNU as | nasm | llvm | 1774|---------------|--------|--------|---------| 1775| AVX | 2.19 | 2.09 | 3.0 | 1776| AVX2 | 2.22 | 2.10 | 3.1 | 1777| ADCX/ADOX | 2.23 | 2.10 | 3.3 | 1778| AVX512 | 2.25 | 2.11.8 | 3.6 (*) | 1779| AVX512IFMA | 2.26 | 2.11.8 | 6.0 (*) | 1780| VAES | 2.30 | 2.13.3 | 6.0 (*) | 1781 1782--- 1783 1784(*) Even though AVX512 support was implemented in llvm 3.6, prior to version 7.0 1785an explicit -march flag was apparently required to compile assembly modules. But 1786then the compiler generates processor-specific code, which in turn contradicts 1787the idea of performing dispatch at run-time, which is facilitated by the special 1788variable `OPENSSL_ia32cap`. For versions older than 7.0, it is possible to work 1789around the problem by forcing the build procedure to use the following script: 1790 1791 #!/bin/sh 1792 exec clang -no-integrated-as "$@" 1793 1794instead of the real clang. In which case it doesn't matter what clang version 1795is used, as it is the version of the GNU assembler that will be checked. 1796 1797--- 1798 1799<!-- Links --> 1800 1801[openssl-users]: 1802 <https://mta.openssl.org/mailman/listinfo/openssl-users> 1803 1804[SUPPORT]: 1805 ./SUPPORT.md 1806 1807[GitHub Issues]: 1808 <https://github.com/openssl/openssl/issues> 1809 1810[raise an issue]: 1811 <https://github.com/openssl/openssl/issues/new/choose> 1812 1813[10-main.conf]: 1814 Configurations/10-main.conf 1815