• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1Build and Install
2=================
3
4This document describes installation on all supported operating
5systems (the Unix/Linux family, including macOS), OpenVMS,
6and Windows).
7
8Table of Contents
9=================
10
11 - [Prerequisites](#prerequisites)
12 - [Notational Conventions](#notational-conventions)
13 - [Quick Installation Guide](#quick-installation-guide)
14   - [Building OpenSSL](#building-openssl)
15   - [Installing OpenSSL](#installing-openssl)
16 - [Configuration Options](#configuration-options)
17   - [API Level](#api-level)
18   - [Cross Compile Prefix](#cross-compile-prefix)
19   - [Build Type](#build-type)
20   - [Directories](#directories)
21   - [Compiler Warnings](#compiler-warnings)
22   - [ZLib Flags](#zlib-flags)
23   - [Seeding the Random Generator](#seeding-the-random-generator)
24   - [Setting the FIPS HMAC key](#setting-the-FIPS-HMAC-key)
25   - [Enable and Disable Features](#enable-and-disable-features)
26   - [Displaying configuration data](#displaying-configuration-data)
27 - [Installation Steps in Detail](#installation-steps-in-detail)
28   - [Configure](#configure-openssl)
29   - [Build](#build-openssl)
30   - [Test](#test-openssl)
31   - [Install](#install-openssl)
32 - [Advanced Build Options](#advanced-build-options)
33   - [Environment Variables](#environment-variables)
34   - [Makefile Targets](#makefile-targets)
35   - [Running Selected Tests](#running-selected-tests)
36 - [Troubleshooting](#troubleshooting)
37   - [Configuration Problems](#configuration-problems)
38   - [Build Failures](#build-failures)
39   - [Test Failures](#test-failures)
40 - [Notes](#notes)
41   - [Notes on multi-threading](#notes-on-multi-threading)
42   - [Notes on shared libraries](#notes-on-shared-libraries)
43   - [Notes on random number generation](#notes-on-random-number-generation)
44   - [Notes on assembler modules compilation](#notes-on-assembler-modules-compilation)
45
46Prerequisites
47=============
48
49To install OpenSSL, you will need:
50
51 * A "make" implementation
52 * Perl 5 with core modules (please read [NOTES-PERL.md](NOTES-PERL.md))
53 * The Perl module `Text::Template` (please read [NOTES-PERL.md](NOTES-PERL.md))
54 * an ANSI C compiler
55 * a development environment in the form of development libraries and C
56   header files
57 * a supported operating system
58
59For additional platform specific requirements, solutions to specific
60issues and other details, please read one of these:
61
62 * [Notes for UNIX-like platforms](NOTES-UNIX.md)
63 * [Notes for Android platforms](NOTES-ANDROID.md)
64 * [Notes for Windows platforms](NOTES-WINDOWS.md)
65 * [Notes for the DOS platform with DJGPP](NOTES-DJGPP.md)
66 * [Notes for the OpenVMS platform](NOTES-VMS.md)
67 * [Notes on Perl](NOTES-PERL.md)
68 * [Notes on Valgrind](NOTES-VALGRIND.md)
69
70Notational conventions
71======================
72
73Throughout this document, we use the following conventions.
74
75Commands
76--------
77
78Any line starting with a dollar sign is a command line.
79
80    $ command
81
82The dollar sign indicates the shell prompt and is not to be entered as
83part of the command.
84
85Choices
86-------
87
88Several words in curly braces separated by pipe characters indicate a
89**mandatory choice**, to be replaced with one of the given words.
90For example, the line
91
92    $ echo { WORD1 | WORD2 | WORD3 }
93
94represents one of the following three commands
95
96    $ echo WORD1
97    - or -
98    $ echo WORD2
99    - or -
100    $ echo WORD3
101
102One or several words in square brackets separated by pipe characters
103denote an **optional choice**.  It is similar to the mandatory choice,
104but it can also be omitted entirely.
105
106So the line
107
108    $ echo [ WORD1 | WORD2 | WORD3 ]
109
110represents one of the four commands
111
112    $ echo WORD1
113    - or -
114    $ echo WORD2
115    - or -
116    $ echo WORD3
117    - or -
118    $ echo
119
120Arguments
121---------
122
123**Mandatory arguments** are enclosed in double curly braces.
124A simple example would be
125
126    $ type {{ filename }}
127
128which is to be understood to use the command `type` on some file name
129determined by the user.
130
131**Optional Arguments** are enclosed in double square brackets.
132
133    [[ options ]]
134
135Note that the notation assumes spaces around `{`, `}`, `[`, `]`, `{{`, `}}` and
136`[[`, `]]`.  This is to differentiate from OpenVMS directory
137specifications, which also use [ and ], but without spaces.
138
139Quick Installation Guide
140========================
141
142If you just want to get OpenSSL installed without bothering too much
143about the details, here is the short version of how to build and install
144OpenSSL.  If any of the following steps fails, please consult the
145[Installation in Detail](#installation-steps-in-detail) section below.
146
147Building OpenSSL
148----------------
149
150Use the following commands to configure, build and test OpenSSL.
151The testing is optional, but recommended if you intend to install
152OpenSSL for production use.
153
154### Unix / Linux / macOS
155
156    $ ./Configure
157    $ make
158    $ make test
159
160### OpenVMS
161
162Use the following commands to build OpenSSL:
163
164    $ perl Configure
165    $ mms
166    $ mms test
167
168### Windows
169
170If you are using Visual Studio, open a Developer Command Prompt and
171issue the following commands to build OpenSSL.
172
173    $ perl Configure
174    $ nmake
175    $ nmake test
176
177As mentioned in the [Choices](#choices) section, you need to pick one
178of the four Configure targets in the first command.
179
180Most likely you will be using the `VC-WIN64A` target for 64bit Windows
181binaries (AMD64) or `VC-WIN32` for 32bit Windows binaries (X86).
182The other two options are `VC-WIN64I` (Intel IA64, Itanium) and
183`VC-CE` (Windows CE) are rather uncommon nowadays.
184
185Installing OpenSSL
186------------------
187
188The following commands will install OpenSSL to a default system location.
189
190**Danger Zone:** even if you are impatient, please read the following two
191paragraphs carefully before you install OpenSSL.
192
193For security reasons the default system location is by default not writable
194for unprivileged users.  So for the final installation step administrative
195privileges are required.  The default system location and the procedure to
196obtain administrative privileges depends on the operating system.
197It is recommended to compile and test OpenSSL with normal user privileges
198and use administrative privileges only for the final installation step.
199
200On some platforms OpenSSL is preinstalled as part of the Operating System.
201In this case it is highly recommended not to overwrite the system versions,
202because other applications or libraries might depend on it.
203To avoid breaking other applications, install your copy of OpenSSL to a
204[different location](#installing-to-a-different-location) which is not in
205the global search path for system libraries.
206
207Finally, if you plan on using the FIPS module, you need to read the
208[Post-installation Notes](#post-installation-notes) further down.
209
210### Unix / Linux / macOS
211
212Depending on your distribution, you need to run the following command as
213root user or prepend `sudo` to the command:
214
215    $ make install
216
217By default, OpenSSL will be installed to
218
219    /usr/local
220
221More precisely, the files will be installed into the  subdirectories
222
223    /usr/local/bin
224    /usr/local/lib
225    /usr/local/include
226    ...
227
228depending on the file type, as it is custom on Unix-like operating systems.
229
230### OpenVMS
231
232Use the following command to install OpenSSL.
233
234    $ mms install
235
236By default, OpenSSL will be installed to
237
238    SYS$COMMON:[OPENSSL]
239
240### Windows
241
242If you are using Visual Studio, open the Developer Command Prompt _elevated_
243and issue the following command.
244
245    $ nmake install
246
247The easiest way to elevate the Command Prompt is to press and hold down both
248the `<CTRL>` and `<SHIFT>` keys while clicking the menu item in the task menu.
249
250The default installation location is
251
252    C:\Program Files\OpenSSL
253
254for native binaries, or
255
256    C:\Program Files (x86)\OpenSSL
257
258for 32bit binaries on 64bit Windows (WOW64).
259
260#### Installing to a different location
261
262To install OpenSSL to a different location (for example into your home
263directory for testing purposes) run `Configure` as shown in the following
264examples.
265
266The options `--prefix` and `--openssldir` are explained in further detail in
267[Directories](#directories) below, and the values used here are mere examples.
268
269On Unix:
270
271    $ ./Configure --prefix=/opt/openssl --openssldir=/usr/local/ssl
272
273On OpenVMS:
274
275    $ perl Configure --prefix=PROGRAM:[INSTALLS] --openssldir=SYS$MANAGER:[OPENSSL]
276
277Note: if you do add options to the configuration command, please make sure
278you've read more than just this Quick Start, such as relevant `NOTES-*` files,
279the options outline below, as configuration options may change the outcome
280in otherwise unexpected ways.
281
282Configuration Options
283=====================
284
285There are several options to `./Configure` to customize the build (note that
286for Windows, the defaults for `--prefix` and `--openssldir` depend on what
287configuration is used and what Windows implementation OpenSSL is built on.
288For more information, see the [Notes for Windows platforms](NOTES-WINDOWS.md).
289
290API Level
291---------
292
293    --api=x.y[.z]
294
295Build the OpenSSL libraries to support the API for the specified version.
296If [no-deprecated](#no-deprecated) is also given, don't build with support
297for deprecated APIs in or below the specified version number.  For example,
298adding
299
300    --api=1.1.0 no-deprecated
301
302will remove support for all APIs that were deprecated in OpenSSL version
3031.1.0 or below.  This is a rather specialized option for developers.
304If you just intend to remove all deprecated APIs up to the current version
305entirely, just specify [no-deprecated](#no-deprecated).
306If `--api` isn't given, it defaults to the current (minor) OpenSSL version.
307
308Cross Compile Prefix
309--------------------
310
311    --cross-compile-prefix=<PREFIX>
312
313The `<PREFIX>` to include in front of commands for your toolchain.
314
315It is likely to have to end with dash, e.g. `a-b-c-` would invoke GNU compiler
316as `a-b-c-gcc`, etc.  Unfortunately cross-compiling is too case-specific to put
317together one-size-fits-all instructions.  You might have to pass more flags or
318set up environment variables to actually make it work.  Android and iOS cases
319are discussed in corresponding `Configurations/15-*.conf` files.  But there are
320cases when this option alone is sufficient.  For example to build the mingw64
321target on Linux `--cross-compile-prefix=x86_64-w64-mingw32-` works.  Naturally
322provided that mingw packages are installed.  Today Debian and Ubuntu users
323have option to install a number of prepackaged cross-compilers along with
324corresponding run-time and development packages for "alien" hardware.  To give
325another example `--cross-compile-prefix=mipsel-linux-gnu-` suffices in such
326case.
327
328For cross compilation, you must [configure manually](#manual-configuration).
329Also, note that `--openssldir` refers to target's file system, not one you are
330building on.
331
332Build Type
333----------
334
335    --debug
336
337Build OpenSSL with debugging symbols and zero optimization level.
338
339    --release
340
341Build OpenSSL without debugging symbols.  This is the default.
342
343Directories
344-----------
345
346### libdir
347
348    --libdir=DIR
349
350The name of the directory under the top of the installation directory tree
351(see the `--prefix` option) where libraries will be installed.  By default
352this is `lib`. Note that on Windows only static libraries (`*.lib`) will
353be stored in this location. Shared libraries (`*.dll`) will always be
354installed to the `bin` directory.
355
356Some build targets have a multilib postfix set in the build configuration.
357For these targets the default libdir is `lib<multilib-postfix>`. Please use
358`--libdir=lib` to override the libdir if adding the postfix is undesirable.
359
360### openssldir
361
362    --openssldir=DIR
363
364Directory for OpenSSL configuration files, and also the default certificate
365and key store.  Defaults are:
366
367    Unix:           /usr/local/ssl
368    Windows:        C:\Program Files\Common Files\SSL
369    OpenVMS:        SYS$COMMON:[OPENSSL-COMMON]
370
371For 32bit Windows applications on Windows 64bit (WOW64), always replace
372`C:\Program Files` by `C:\Program Files (x86)`.
373
374### prefix
375
376    --prefix=DIR
377
378The top of the installation directory tree.  Defaults are:
379
380    Unix:           /usr/local
381    Windows:        C:\Program Files\OpenSSL
382    OpenVMS:        SYS$COMMON:[OPENSSL]
383
384Compiler Warnings
385-----------------
386
387    --strict-warnings
388
389This is a developer flag that switches on various compiler options recommended
390for OpenSSL development.  It only works when using gcc or clang as the compiler.
391If you are developing a patch for OpenSSL then it is recommended that you use
392this option where possible.
393
394ZLib Flags
395----------
396
397### with-zlib-include
398
399    --with-zlib-include=DIR
400
401The directory for the location of the zlib include file.  This option is only
402necessary if [zlib](#zlib) is used and the include file is not
403already on the system include path.
404
405### with-zlib-lib
406
407    --with-zlib-lib=LIB
408
409**On Unix**: this is the directory containing the zlib library.
410If not provided the system library path will be used.
411
412**On Windows:** this is the filename of the zlib library (with or
413without a path).  This flag must be provided if the
414[zlib-dynamic](#zlib-dynamic) option is not also used. If `zlib-dynamic` is used
415then this flag is optional and defaults to `ZLIB1` if not provided.
416
417**On VMS:** this is the filename of the zlib library (with or without a path).
418This flag is optional and if not provided then `GNV$LIBZSHR`, `GNV$LIBZSHR32`
419or `GNV$LIBZSHR64` is used by default depending on the pointer size chosen.
420
421Seeding the Random Generator
422----------------------------
423
424    --with-rand-seed=seed1[,seed2,...]
425
426A comma separated list of seeding methods which will be tried by OpenSSL
427in order to obtain random input (a.k.a "entropy") for seeding its
428cryptographically secure random number generator (CSPRNG).
429The current seeding methods are:
430
431### os
432
433Use a trusted operating system entropy source.
434This is the default method if such an entropy source exists.
435
436### getrandom
437
438Use the [getrandom(2)][man-getrandom] or equivalent system call.
439
440[man-getrandom]: http://man7.org/linux/man-pages/man2/getrandom.2.html
441
442### devrandom
443
444Use the first device from the `DEVRANDOM` list which can be opened to read
445random bytes.  The `DEVRANDOM` preprocessor constant expands to
446
447    "/dev/urandom","/dev/random","/dev/srandom"
448
449on most unix-ish operating systems.
450
451### egd
452
453Check for an entropy generating daemon.
454This source is ignored by the FIPS provider.
455
456### rdcpu
457
458Use the `RDSEED` or `RDRAND` command if provided by the CPU.
459
460### librandom
461
462Use librandom (not implemented yet).
463This source is ignored by the FIPS provider.
464
465### none
466
467Disable automatic seeding.  This is the default on some operating systems where
468no suitable entropy source exists, or no support for it is implemented yet.
469This option is ignored by the FIPS provider.
470
471For more information, see the section [Notes on random number generation][rng]
472at the end of this document.
473
474[rng]: #notes-on-random-number-generation
475
476Setting the FIPS HMAC key
477-------------------------
478
479    --fips-key=value
480
481As part of its self-test validation, the FIPS module must verify itself
482by performing a SHA-256 HMAC computation on itself. The default key is
483the SHA256 value of "the holy handgrenade of antioch" and is sufficient
484for meeting the FIPS requirements.
485
486To change the key to a different value, use this flag. The value should
487be a hex string no more than 64 characters.
488
489Enable and Disable Features
490---------------------------
491
492Feature options always come in pairs, an option to enable feature
493`xxxx`, and an option to disable it:
494
495    [ enable-xxxx | no-xxxx ]
496
497Whether a feature is enabled or disabled by default, depends on the feature.
498In the following list, always the non-default variant is documented: if
499feature `xxxx` is disabled by default then `enable-xxxx` is documented and
500if feature `xxxx` is enabled by default then `no-xxxx` is documented.
501
502### no-afalgeng
503
504Don't build the AFALG engine.
505
506This option will be forced on a platform that does not support AFALG.
507
508### enable-ktls
509
510Build with Kernel TLS support.
511
512This option will enable the use of the Kernel TLS data-path, which can improve
513performance and allow for the use of sendfile and splice system calls on
514TLS sockets.  The Kernel may use TLS accelerators if any are available on the
515system.  This option will be forced off on systems that do not support the
516Kernel TLS data-path.
517
518### enable-asan
519
520Build with the Address sanitiser.
521
522This is a developer option only.  It may not work on all platforms and should
523never be used in production environments.  It will only work when used with
524gcc or clang and should be used in conjunction with the [no-shared](#no-shared)
525option.
526
527### enable-acvp-tests
528
529Build support for Automated Cryptographic Validation Protocol (ACVP)
530tests.
531
532This is required for FIPS validation purposes. Certain ACVP tests require
533access to algorithm internals that are not normally accessible.
534Additional information related to ACVP can be found at
535<https://github.com/usnistgov/ACVP>.
536
537### no-asm
538
539Do not use assembler code.
540
541This should be viewed as debugging/troubleshooting option rather than for
542production use.  On some platforms a small amount of assembler code may still
543be used even with this option.
544
545### no-async
546
547Do not build support for async operations.
548
549### no-autoalginit
550
551Don't automatically load all supported ciphers and digests.
552
553Typically OpenSSL will make available all of its supported ciphers and digests.
554For a statically linked application this may be undesirable if small executable
555size is an objective.  This only affects libcrypto.  Ciphers and digests will
556have to be loaded manually using `EVP_add_cipher()` and `EVP_add_digest()`
557if this option is used.  This option will force a non-shared build.
558
559### no-autoerrinit
560
561Don't automatically load all libcrypto/libssl error strings.
562
563Typically OpenSSL will automatically load human readable error strings.  For a
564statically linked application this may be undesirable if small executable size
565is an objective.
566
567### no-autoload-config
568
569Don't automatically load the default `openssl.cnf` file.
570
571Typically OpenSSL will automatically load a system config file which configures
572default SSL options.
573
574### enable-buildtest-c++
575
576While testing, generate C++ buildtest files that simply check that the public
577OpenSSL header files are usable standalone with C++.
578
579Enabling this option demands extra care.  For any compiler flag given directly
580as configuration option, you must ensure that it's valid for both the C and
581the C++ compiler.  If not, the C++ build test will most likely break.  As an
582alternative, you can use the language specific variables, `CFLAGS` and `CXXFLAGS`.
583
584### --banner=text
585
586Use the specified text instead of the default banner at the end of
587configuration.
588
589### --w
590
591On platforms where the choice of 32-bit or 64-bit architecture
592is not explicitly specified, `Configure` will print a warning
593message and wait for a few seconds to let you interrupt the
594configuration. Using this flag skips the wait.
595
596### no-bulk
597
598Build only some minimal set of features.
599This is a developer option used internally for CI build tests of the project.
600
601### no-cached-fetch
602
603Never cache algorithms when they are fetched from a provider.  Normally, a
604provider indicates if the algorithms it supplies can be cached or not.  Using
605this option will reduce run-time memory usage but it also introduces a
606significant performance penalty.  This option is primarily designed to help
607with detecting incorrect reference counting.
608
609### no-capieng
610
611Don't build the CAPI engine.
612
613This option will be forced if on a platform that does not support CAPI.
614
615### no-cmp
616
617Don't build support for Certificate Management Protocol (CMP)
618and Certificate Request Message Format (CRMF).
619
620### no-cms
621
622Don't build support for Cryptographic Message Syntax (CMS).
623
624### no-comp
625
626Don't build support for SSL/TLS compression.
627
628If this option is enabled (the default), then compression will only work if
629the zlib or `zlib-dynamic` options are also chosen.
630
631### enable-crypto-mdebug
632
633This now only enables the `failed-malloc` feature.
634
635### enable-crypto-mdebug-backtrace
636
637This is a no-op; the project uses the compiler's address/leak sanitizer instead.
638
639### no-ct
640
641Don't build support for Certificate Transparency (CT).
642
643### no-deprecated
644
645Don't build with support for deprecated APIs up until and including the version
646given with `--api` (or the current version, if `--api` wasn't specified).
647
648### no-dgram
649
650Don't build support for datagram based BIOs.
651
652Selecting this option will also force the disabling of DTLS.
653
654### no-dso
655
656Don't build support for loading Dynamic Shared Objects (DSO)
657
658### enable-devcryptoeng
659
660Build the `/dev/crypto` engine.
661
662This option is automatically selected on the BSD platform, in which case it can
663be disabled with `no-devcryptoeng`.
664
665### no-dynamic-engine
666
667Don't build the dynamically loaded engines.
668
669This only has an effect in a shared build.
670
671### no-ec
672
673Don't build support for Elliptic Curves.
674
675### no-ec2m
676
677Don't build support for binary Elliptic Curves
678
679### enable-ec_nistp_64_gcc_128
680
681Enable support for optimised implementations of some commonly used NIST
682elliptic curves.
683
684This option is only supported on platforms:
685
686 - with little-endian storage of non-byte types
687 - that tolerate misaligned memory references
688 - where the compiler:
689   - supports the non-standard type `__uint128_t`
690   - defines the built-in macro `__SIZEOF_INT128__`
691
692### enable-egd
693
694Build support for gathering entropy from the Entropy Gathering Daemon (EGD).
695
696### no-engine
697
698Don't build support for loading engines.
699
700### no-err
701
702Don't compile in any error strings.
703
704### enable-external-tests
705
706Enable building of integration with external test suites.
707
708This is a developer option and may not work on all platforms.  The following
709external test suites are currently supported:
710
711 - GOST engine test suite
712 - Python PYCA/Cryptography test suite
713 - krb5 test suite
714
715See the file [test/README-external.md](test/README-external.md)
716for further details.
717
718### no-filenames
719
720Don't compile in filename and line number information (e.g.  for errors and
721memory allocation).
722
723### enable-fips
724
725Build (and install) the FIPS provider
726
727### no-fips-securitychecks
728
729Don't perform FIPS module run-time checks related to enforcement of security
730parameters such as minimum security strength of keys.
731
732### enable-fuzz-libfuzzer, enable-fuzz-afl
733
734Build with support for fuzzing using either libfuzzer or AFL.
735
736These are developer options only.  They may not work on all  platforms and
737should never be used in production environments.
738
739See the file [fuzz/README.md](fuzz/README.md) for further details.
740
741### no-gost
742
743Don't build support for GOST based ciphersuites.
744
745Note that if this feature is enabled then GOST ciphersuites are only available
746if the GOST algorithms are also available through loading an externally supplied
747engine.
748
749### no-legacy
750
751Don't build the legacy provider.
752
753Disabling this also disables the legacy algorithms: MD2 (already disabled by default).
754
755### no-makedepend
756
757Don't generate dependencies.
758
759### no-module
760
761Don't build any dynamically loadable engines.
762
763This also implies `no-dynamic-engine`.
764
765### no-multiblock
766
767Don't build support for writing multiple records in one go in libssl
768
769Note: this is a different capability to the pipelining functionality.
770
771### no-nextprotoneg
772
773Don't build support for the Next Protocol Negotiation (NPN) TLS extension.
774
775### no-ocsp
776
777Don't build support for Online Certificate Status Protocol (OCSP).
778
779### no-padlockeng
780
781Don't build the padlock engine.
782
783### no-hw-padlock
784
785As synonym for `no-padlockeng`.  Deprecated and should not be used.
786
787### no-pic
788
789Don't build with support for Position Independent Code.
790
791### no-pinshared
792
793Don't pin the shared libraries.
794
795By default OpenSSL will attempt to stay in memory until the process exits.
796This is so that libcrypto and libssl can be properly cleaned up automatically
797via an `atexit()` handler.  The handler is registered by libcrypto and cleans
798up both libraries.  On some platforms the `atexit()` handler will run on unload of
799libcrypto (if it has been dynamically loaded) rather than at process exit.  This
800option can be used to stop OpenSSL from attempting to stay in memory until the
801process exits.  This could lead to crashes if either libcrypto or libssl have
802already been unloaded at the point that the atexit handler is invoked, e.g.  on a
803platform which calls `atexit()` on unload of the library, and libssl is unloaded
804before libcrypto then a crash is likely to happen.  Applications can suppress
805running of the `atexit()` handler at run time by using the
806`OPENSSL_INIT_NO_ATEXIT` option to `OPENSSL_init_crypto()`.
807See the man page for it for further details.
808
809### no-posix-io
810
811Don't use POSIX IO capabilities.
812
813### no-psk
814
815Don't build support for Pre-Shared Key based ciphersuites.
816
817### no-rdrand
818
819Don't use hardware RDRAND capabilities.
820
821### no-rfc3779
822
823Don't build support for RFC3779, "X.509 Extensions for IP Addresses and
824AS Identifiers".
825
826### sctp
827
828Build support for Stream Control Transmission Protocol (SCTP).
829
830### no-shared
831
832Do not create shared libraries, only static ones.
833
834See [Notes on shared libraries](#notes-on-shared-libraries) below.
835
836### no-sock
837
838Don't build support for socket BIOs.
839
840### no-srp
841
842Don't build support for Secure Remote Password (SRP) protocol or
843SRP based ciphersuites.
844
845### no-srtp
846
847Don't build Secure Real-Time Transport Protocol (SRTP) support.
848
849### no-sse2
850
851Exclude SSE2 code paths from 32-bit x86 assembly modules.
852
853Normally SSE2 extension is detected at run-time, but the decision whether or not
854the machine code will be executed is taken solely on CPU capability vector.  This
855means that if you happen to run OS kernel which does not support SSE2 extension
856on Intel P4 processor, then your application might be exposed to "illegal
857instruction" exception.  There might be a way to enable support in kernel, e.g.
858FreeBSD kernel can be compiled with `CPU_ENABLE_SSE`, and there is a way to
859disengage SSE2 code paths upon application start-up, but if you aim for wider
860"audience" running such kernel, consider `no-sse2`.  Both the `386` and `no-asm`
861options imply `no-sse2`.
862
863### no-ssl-trace
864
865Don't build with SSL Trace capabilities.
866
867This removes the `-trace` option from `s_client` and `s_server`, and omits the
868`SSL_trace()` function from libssl.
869
870Disabling `ssl-trace` may provide a small reduction in libssl binary size.
871
872### no-static-engine
873
874Don't build the statically linked engines.
875
876This only has an impact when not built "shared".
877
878### no-stdio
879
880Don't use anything from the C header file `stdio.h` that makes use of the `FILE`
881type.  Only libcrypto and libssl can be built in this way.  Using this option will
882suppress building the command line applications.  Additionally, since the OpenSSL
883tests also use the command line applications, the tests will also be skipped.
884
885### no-tests
886
887Don't build test programs or run any tests.
888
889### no-threads
890
891Don't build with support for multi-threaded applications.
892
893### threads
894
895Build with support for multi-threaded applications.  Most platforms will enable
896this by default.  However, if on a platform where this is not the case then this
897will usually require additional system-dependent options!
898
899See [Notes on multi-threading](#notes-on-multi-threading) below.
900
901### enable-trace
902
903Build with support for the integrated tracing api.
904
905See manual pages OSSL_trace_set_channel(3) and OSSL_trace_enabled(3) for details.
906
907### no-ts
908
909Don't build Time Stamping (TS) Authority support.
910
911### enable-ubsan
912
913Build with the Undefined Behaviour sanitiser (UBSAN).
914
915This is a developer option only.  It may not work on all platforms and should
916never be used in production environments.  It will only work when used with
917gcc or clang and should be used in conjunction with the `-DPEDANTIC` option
918(or the `--strict-warnings` option).
919
920### no-ui-console
921
922Don't build with the User Interface (UI) console method
923
924The User Interface console method enables text based console prompts.
925
926### enable-unit-test
927
928Enable additional unit test APIs.
929
930This should not typically be used in production deployments.
931
932### no-uplink
933
934Don't build support for UPLINK interface.
935
936### enable-weak-ssl-ciphers
937
938Build support for SSL/TLS ciphers that are considered "weak"
939
940Enabling this includes for example the RC4 based ciphersuites.
941
942### zlib
943
944Build with support for zlib compression/decompression.
945
946### zlib-dynamic
947
948Like the zlib option, but has OpenSSL load the zlib library dynamically
949when needed.
950
951This is only supported on systems where loading of shared libraries is supported.
952
953### 386
954
955In 32-bit x86 builds, use the 80386 instruction set only in assembly modules
956
957The default x86 code is more efficient, but requires at least an 486 processor.
958Note: This doesn't affect compiler generated code, so this option needs to be
959accompanied by a corresponding compiler-specific option.
960
961### no-{protocol}
962
963    no-{ssl|ssl3|tls|tls1|tls1_1|tls1_2|tls1_3|dtls|dtls1|dtls1_2}
964
965Don't build support for negotiating the specified SSL/TLS protocol.
966
967If `no-tls` is selected then all of `tls1`, `tls1_1`, `tls1_2` and `tls1_3`
968are disabled.
969Similarly `no-dtls` will disable `dtls1` and `dtls1_2`.  The `no-ssl` option is
970synonymous with `no-ssl3`.  Note this only affects version negotiation.
971OpenSSL will still provide the methods for applications to explicitly select
972the individual protocol versions.
973
974### no-{protocol}-method
975
976    no-{ssl3|tls1|tls1_1|tls1_2|dtls1|dtls1_2}-method
977
978Analogous to `no-{protocol}` but in addition do not build the methods for
979applications to explicitly select individual protocol versions.  Note that there
980is no `no-tls1_3-method` option because there is no application method for
981TLSv1.3.
982
983Using individual protocol methods directly is deprecated.  Applications should
984use `TLS_method()` instead.
985
986### enable-{algorithm}
987
988    enable-{md2|rc5}
989
990Build with support for the specified algorithm.
991
992### no-{algorithm}
993
994    no-{aria|bf|blake2|camellia|cast|chacha|cmac|
995        des|dh|dsa|ecdh|ecdsa|idea|md4|mdc2|ocb|
996        poly1305|rc2|rc4|rmd160|scrypt|seed|
997        siphash|siv|sm2|sm3|sm4|whirlpool}
998
999Build without support for the specified algorithm.
1000
1001The `ripemd` algorithm is deprecated and if used is synonymous with `rmd160`.
1002
1003### Compiler-specific options
1004
1005    -Dxxx, -Ixxx, -Wp, -lxxx, -Lxxx, -Wl, -rpath, -R, -framework, -static
1006
1007These system specific options will be recognised and passed through to the
1008compiler to allow you to define preprocessor symbols, specify additional
1009libraries, library directories or other compiler options.  It might be worth
1010noting that some compilers generate code specifically for processor the
1011compiler currently executes on.  This is not necessarily what you might have
1012in mind, since it might be unsuitable for execution on other, typically older,
1013processor.  Consult your compiler documentation.
1014
1015Take note of the [Environment Variables](#environment-variables) documentation
1016below and how these flags interact with those variables.
1017
1018    -xxx, +xxx, /xxx
1019
1020Additional options that are not otherwise recognised are passed through as
1021they are to the compiler as well.  Unix-style options beginning with a
1022`-` or `+` and Windows-style options beginning with a `/` are recognized.
1023Again, consult your compiler documentation.
1024
1025If the option contains arguments separated by spaces, then the URL-style
1026notation `%20` can be used for the space character in order to avoid having
1027to quote the option.  For example, `-opt%20arg` gets expanded to `-opt arg`.
1028In fact, any ASCII character can be encoded as %xx using its hexadecimal
1029encoding.
1030
1031Take note of the [Environment Variables](#environment-variables) documentation
1032below and how these flags interact with those variables.
1033
1034### Environment Variables
1035
1036    VAR=value
1037
1038Assign the given value to the environment variable `VAR` for `Configure`.
1039
1040These work just like normal environment variable assignments, but are supported
1041on all platforms and are confined to the configuration scripts only.
1042These assignments override the corresponding value in the inherited environment,
1043if there is one.
1044
1045The following variables are used as "`make` variables" and can be used as an
1046alternative to giving preprocessor, compiler and linker options directly as
1047configuration.  The following variables are supported:
1048
1049    AR              The static library archiver.
1050    ARFLAGS         Flags for the static library archiver.
1051    AS              The assembler compiler.
1052    ASFLAGS         Flags for the assembler compiler.
1053    CC              The C compiler.
1054    CFLAGS          Flags for the C compiler.
1055    CXX             The C++ compiler.
1056    CXXFLAGS        Flags for the C++ compiler.
1057    CPP             The C/C++ preprocessor.
1058    CPPFLAGS        Flags for the C/C++ preprocessor.
1059    CPPDEFINES      List of CPP macro definitions, separated
1060                    by a platform specific character (':' or
1061                    space for Unix, ';' for Windows, ',' for
1062                    VMS).  This can be used instead of using
1063                    -D (or what corresponds to that on your
1064                    compiler) in CPPFLAGS.
1065    CPPINCLUDES     List of CPP inclusion directories, separated
1066                    the same way as for CPPDEFINES.  This can
1067                    be used instead of -I (or what corresponds
1068                    to that on your compiler) in CPPFLAGS.
1069    HASHBANGPERL    Perl invocation to be inserted after '#!'
1070                    in public perl scripts (only relevant on
1071                    Unix).
1072    LD              The program linker (not used on Unix, $(CC)
1073                    is used there).
1074    LDFLAGS         Flags for the shared library, DSO and
1075                    program linker.
1076    LDLIBS          Extra libraries to use when linking.
1077                    Takes the form of a space separated list
1078                    of library specifications on Unix and
1079                    Windows, and as a comma separated list of
1080                    libraries on VMS.
1081    RANLIB          The library archive indexer.
1082    RC              The Windows resource compiler.
1083    RCFLAGS         Flags for the Windows resource compiler.
1084    RM              The command to remove files and directories.
1085
1086These cannot be mixed with compiling/linking flags given on the command line.
1087In other words, something like this isn't permitted.
1088
1089    $ ./Configure -DFOO CPPFLAGS=-DBAR -DCOOKIE
1090
1091Backward compatibility note:
1092
1093To be compatible with older configuration scripts, the environment variables
1094are ignored if compiling/linking flags are given on the command line, except
1095for the following:
1096
1097    AR, CC, CXX, CROSS_COMPILE, HASHBANGPERL, PERL, RANLIB, RC, and WINDRES
1098
1099For example, the following command will not see `-DBAR`:
1100
1101    $ CPPFLAGS=-DBAR ./Configure -DCOOKIE
1102
1103However, the following will see both set variables:
1104
1105    $ CC=gcc CROSS_COMPILE=x86_64-w64-mingw32- ./Configure -DCOOKIE
1106
1107If `CC` is set, it is advisable to also set `CXX` to ensure both the C and C++
1108compiler are in the same "family".  This becomes relevant with
1109`enable-external-tests` and `enable-buildtest-c++`.
1110
1111### Reconfigure
1112
1113    reconf
1114    reconfigure
1115
1116Reconfigure from earlier data.
1117
1118This fetches the previous command line options and environment from data
1119saved in `configdata.pm` and runs the configuration process again, using
1120these options and environment.  Note: NO other option is permitted together
1121with `reconf`.  Note: The original configuration saves away values for ALL
1122environment variables that were used, and if they weren't defined, they are
1123still saved away with information that they weren't originally defined.
1124This information takes precedence over environment variables that are
1125defined when reconfiguring.
1126
1127Displaying configuration data
1128-----------------------------
1129
1130The configuration script itself will say very little, and finishes by
1131creating `configdata.pm`.  This perl module can be loaded by other scripts
1132to find all the configuration data, and it can also be used as a script to
1133display all sorts of configuration data in a human readable form.
1134
1135For more information, please do:
1136
1137    $ ./configdata.pm --help                         # Unix
1138
1139or
1140
1141    $ perl configdata.pm --help                      # Windows and VMS
1142
1143Installation Steps in Detail
1144============================
1145
1146Configure OpenSSL
1147-----------------
1148
1149### Automatic Configuration
1150
1151In previous version, the `config` script determined the platform type and
1152compiler and then called `Configure`. Starting with this release, they are
1153the same.
1154
1155#### Unix / Linux / macOS
1156
1157    $ ./Configure [[ options ]]
1158
1159#### OpenVMS
1160
1161    $ perl Configure [[ options ]]
1162
1163#### Windows
1164
1165    $ perl Configure [[ options ]]
1166
1167### Manual Configuration
1168
1169OpenSSL knows about a range of different operating system, hardware and
1170compiler combinations.  To see the ones it knows about, run
1171
1172    $ ./Configure LIST                               # Unix
1173
1174or
1175
1176    $ perl Configure LIST                            # All other platforms
1177
1178For the remainder of this text, the Unix form will be used in all examples.
1179Please use the appropriate form for your platform.
1180
1181Pick a suitable name from the list that matches your system.  For most
1182operating systems there is a choice between using cc or gcc.
1183When you have identified your system (and if necessary compiler) use this
1184name as the argument to `Configure`.  For example, a `linux-elf` user would
1185run:
1186
1187    $ ./Configure linux-elf [[ options ]]
1188
1189### Creating your own Configuration
1190
1191If your system isn't listed, you will have to create a configuration
1192file named `Configurations/{{ something }}.conf` and add the correct
1193configuration for your system.  See the available configs as examples
1194and read [Configurations/README.md](Configurations/README.md) and
1195[Configurations/README-design.md](Configurations/README-design.md)
1196for more information.
1197
1198The generic configurations `cc` or `gcc` should usually work on 32 bit
1199Unix-like systems.
1200
1201`Configure` creates a build file (`Makefile` on Unix, `makefile` on Windows
1202and `descrip.mms` on OpenVMS) from a suitable template in `Configurations/`,
1203and defines various macros in `include/openssl/configuration.h` (generated
1204from `include/openssl/configuration.h.in`.
1205
1206If none of the generated build files suit your purpose, it's possible to
1207write your own build file template and give its name through the environment
1208variable `BUILDFILE`.  For example, Ninja build files could be supported by
1209writing `Configurations/build.ninja.tmpl` and then configure with `BUILDFILE`
1210set like this (Unix syntax shown, you'll have to adapt for other platforms):
1211
1212    $ BUILDFILE=build.ninja perl Configure [options...]
1213
1214### Out of Tree Builds
1215
1216OpenSSL can be configured to build in a build directory separate from the
1217source code directory.  It's done by placing yourself in some other
1218directory and invoking the configuration commands from there.
1219
1220#### Unix example
1221
1222    $ mkdir /var/tmp/openssl-build
1223    $ cd /var/tmp/openssl-build
1224    $ /PATH/TO/OPENSSL/SOURCE/Configure [[ options ]]
1225
1226#### OpenVMS example
1227
1228    $ set default sys$login:
1229    $ create/dir [.tmp.openssl-build]
1230    $ set default [.tmp.openssl-build]
1231    $ perl D:[PATH.TO.OPENSSL.SOURCE]Configure [[ options ]]
1232
1233#### Windows example
1234
1235    $ C:
1236    $ mkdir \temp-openssl
1237    $ cd \temp-openssl
1238    $ perl d:\PATH\TO\OPENSSL\SOURCE\Configure [[ options ]]
1239
1240Paths can be relative just as well as absolute.  `Configure` will do its best
1241to translate them to relative paths whenever possible.
1242
1243Build OpenSSL
1244-------------
1245
1246Build OpenSSL by running:
1247
1248    $ make                                           # Unix
1249    $ mms                                            ! (or mmk) OpenVMS
1250    $ nmake                                          # Windows
1251
1252This will build the OpenSSL libraries (`libcrypto.a` and `libssl.a` on
1253Unix, corresponding on other platforms) and the OpenSSL binary
1254(`openssl`).  The libraries will be built in the top-level directory,
1255and the binary will be in the `apps/` subdirectory.
1256
1257If the build fails, take a look at the [Build Failures](#build-failures)
1258subsection of the [Troubleshooting](#troubleshooting) section.
1259
1260Test OpenSSL
1261------------
1262
1263After a successful build, and before installing, the libraries should
1264be tested.  Run:
1265
1266    $ make test                                      # Unix
1267    $ mms test                                       ! OpenVMS
1268    $ nmake test                                     # Windows
1269
1270**Warning:** you MUST run the tests from an unprivileged account (or disable
1271your privileges temporarily if your platform allows it).
1272
1273See [test/README.md](test/README.md) for further details how run tests.
1274
1275See [test/README-dev.md](test/README-dev.md) for guidelines on adding tests.
1276
1277Install OpenSSL
1278---------------
1279
1280If everything tests ok, install OpenSSL with
1281
1282    $ make install                                   # Unix
1283    $ mms install                                    ! OpenVMS
1284    $ nmake install                                  # Windows
1285
1286Note that in order to perform the install step above you need to have
1287appropriate permissions to write to the installation directory.
1288
1289The above commands will install all the software components in this
1290directory tree under `<PREFIX>` (the directory given with `--prefix` or
1291its default):
1292
1293### Unix / Linux / macOS
1294
1295    bin/           Contains the openssl binary and a few other
1296                   utility scripts.
1297    include/openssl
1298                   Contains the header files needed if you want
1299                   to build your own programs that use libcrypto
1300                   or libssl.
1301    lib            Contains the OpenSSL library files.
1302    lib/engines    Contains the OpenSSL dynamically loadable engines.
1303
1304    share/man/man1 Contains the OpenSSL command line man-pages.
1305    share/man/man3 Contains the OpenSSL library calls man-pages.
1306    share/man/man5 Contains the OpenSSL configuration format man-pages.
1307    share/man/man7 Contains the OpenSSL other misc man-pages.
1308
1309    share/doc/openssl/html/man1
1310    share/doc/openssl/html/man3
1311    share/doc/openssl/html/man5
1312    share/doc/openssl/html/man7
1313                   Contains the HTML rendition of the man-pages.
1314
1315### OpenVMS
1316
1317'arch' is replaced with the architecture name, `ALPHA` or `IA64`,
1318'sover' is replaced with the shared library version (`0101` for 1.1), and
1319'pz' is replaced with the pointer size OpenSSL was built with:
1320
1321    [.EXE.'arch']  Contains the openssl binary.
1322    [.EXE]         Contains a few utility scripts.
1323    [.include.openssl]
1324                   Contains the header files needed if you want
1325                   to build your own programs that use libcrypto
1326                   or libssl.
1327    [.LIB.'arch']  Contains the OpenSSL library files.
1328    [.ENGINES'sover''pz'.'arch']
1329                   Contains the OpenSSL dynamically loadable engines.
1330    [.SYS$STARTUP] Contains startup, login and shutdown scripts.
1331                   These define appropriate logical names and
1332                   command symbols.
1333    [.SYSTEST]     Contains the installation verification procedure.
1334    [.HTML]        Contains the HTML rendition of the manual pages.
1335
1336### Additional Directories
1337
1338Additionally, install will add the following directories under
1339OPENSSLDIR (the directory given with `--openssldir` or its default)
1340for you convenience:
1341
1342    certs          Initially empty, this is the default location
1343                   for certificate files.
1344    private        Initially empty, this is the default location
1345                   for private key files.
1346    misc           Various scripts.
1347
1348The installation directory should be appropriately protected to ensure
1349unprivileged users cannot make changes to OpenSSL binaries or files, or
1350install engines.  If you already have a pre-installed version of OpenSSL as
1351part of your Operating System it is recommended that you do not overwrite
1352the system version and instead install to somewhere else.
1353
1354Package builders who want to configure the library for standard locations,
1355but have the package installed somewhere else so that it can easily be
1356packaged, can use
1357
1358    $ make DESTDIR=/tmp/package-root install         # Unix
1359    $ mms/macro="DESTDIR=TMP:[PACKAGE-ROOT]" install ! OpenVMS
1360
1361The specified destination directory will be prepended to all installation
1362target paths.
1363
1364Compatibility issues with previous OpenSSL versions
1365---------------------------------------------------
1366
1367### COMPILING existing applications
1368
1369Starting with version 1.1.0, OpenSSL hides a number of structures that were
1370previously open.  This includes all internal libssl structures and a number
1371of EVP types.  Accessor functions have been added to allow controlled access
1372to the structures' data.
1373
1374This means that some software needs to be rewritten to adapt to the new ways
1375of doing things.  This often amounts to allocating an instance of a structure
1376explicitly where you could previously allocate them on the stack as automatic
1377variables, and using the provided accessor functions where you would previously
1378access a structure's field directly.
1379
1380Some APIs have changed as well.  However, older APIs have been preserved when
1381possible.
1382
1383Post-installation Notes
1384-----------------------
1385
1386With the default OpenSSL installation comes a FIPS provider module, which
1387needs some post-installation attention, without which it will not be usable.
1388This involves using the following command:
1389
1390    $ openssl fipsinstall
1391
1392See the openssl-fipsinstall(1) manual for details and examples.
1393
1394Advanced Build Options
1395======================
1396
1397Environment Variables
1398---------------------
1399
1400A number of environment variables can be used to provide additional control
1401over the build process.  Typically these should be defined prior to running
1402`Configure`.  Not all environment variables are relevant to all platforms.
1403
1404    AR
1405                   The name of the ar executable to use.
1406
1407    BUILDFILE
1408                   Use a different build file name than the platform default
1409                   ("Makefile" on Unix-like platforms, "makefile" on native Windows,
1410                   "descrip.mms" on OpenVMS).  This requires that there is a
1411                   corresponding build file template.
1412                   See [Configurations/README.md](Configurations/README.md)
1413                   for further information.
1414
1415    CC
1416                   The compiler to use. Configure will attempt to pick a default
1417                   compiler for your platform but this choice can be overridden
1418                   using this variable. Set it to the compiler executable you wish
1419                   to use, e.g. gcc or clang.
1420
1421    CROSS_COMPILE
1422                   This environment variable has the same meaning as for the
1423                   "--cross-compile-prefix" Configure flag described above. If both
1424                   are set then the Configure flag takes precedence.
1425
1426    HASHBANGPERL
1427                   The command string for the Perl executable to insert in the
1428                   #! line of perl scripts that will be publicly installed.
1429                   Default: /usr/bin/env perl
1430                   Note: the value of this variable is added to the same scripts
1431                   on all platforms, but it's only relevant on Unix-like platforms.
1432
1433    KERNEL_BITS
1434                   This can be the value `32` or `64` to specify the architecture
1435                   when it is not "obvious" to the configuration. It should generally
1436                   not be necessary to specify this environment variable.
1437
1438    NM
1439                   The name of the nm executable to use.
1440
1441    OPENSSL_LOCAL_CONFIG_DIR
1442                   OpenSSL comes with a database of information about how it
1443                   should be built on different platforms as well as build file
1444                   templates for those platforms. The database is comprised of
1445                   ".conf" files in the Configurations directory.  The build
1446                   file templates reside there as well as ".tmpl" files. See the
1447                   file [Configurations/README.md](Configurations/README.md)
1448                   for further information about the format of ".conf" files
1449                   as well as information on the ".tmpl" files.
1450                   In addition to the standard ".conf" and ".tmpl" files, it is
1451                   possible to create your own ".conf" and ".tmpl" files and
1452                   store them locally, outside the OpenSSL source tree.
1453                   This environment variable can be set to the directory where
1454                   these files are held and will be considered by Configure
1455                   before it looks in the standard directories.
1456
1457    PERL
1458                   The name of the Perl executable to use when building OpenSSL.
1459                   Only needed if builing should use a different Perl executable
1460                   than what is used to run the Configure script.
1461
1462    RANLIB
1463                   The name of the ranlib executable to use.
1464
1465    RC
1466                   The name of the rc executable to use. The default will be as
1467                   defined for the target platform in the ".conf" file. If not
1468                   defined then "windres" will be used. The WINDRES environment
1469                   variable is synonymous to this. If both are defined then RC
1470                   takes precedence.
1471
1472    WINDRES
1473                   See RC.
1474
1475Makefile Targets
1476----------------
1477
1478The `Configure` script generates a Makefile in a format relevant to the specific
1479platform.  The Makefiles provide a number of targets that can be used.  Not all
1480targets may be available on all platforms.  Only the most common targets are
1481described here.  Examine the Makefiles themselves for the full list.
1482
1483    all
1484                   The target to build all the software components and
1485                   documentation.
1486
1487    build_sw
1488                   Build all the software components.
1489                   THIS IS THE DEFAULT TARGET.
1490
1491    build_docs
1492                   Build all documentation components.
1493
1494    clean
1495                   Remove all build artefacts and return the directory to a "clean"
1496                   state.
1497
1498    depend
1499                   Rebuild the dependencies in the Makefiles. This is a legacy
1500                   option that no longer needs to be used since OpenSSL 1.1.0.
1501
1502    install
1503                   Install all OpenSSL components.
1504
1505    install_sw
1506                   Only install the OpenSSL software components.
1507
1508    install_docs
1509                   Only install the OpenSSL documentation components.
1510
1511    install_man_docs
1512                   Only install the OpenSSL man pages (Unix only).
1513
1514    install_html_docs
1515                   Only install the OpenSSL HTML documentation.
1516
1517    install_fips
1518                   Install the FIPS provider module configuration file.
1519
1520    list-tests
1521                   Prints a list of all the self test names.
1522
1523    test
1524                   Build and run the OpenSSL self tests.
1525
1526    uninstall
1527                   Uninstall all OpenSSL components.
1528
1529    reconfigure
1530    reconf
1531                   Re-run the configuration process, as exactly as the last time
1532                   as possible.
1533
1534    update
1535                   This is a developer option. If you are developing a patch for
1536                   OpenSSL you may need to use this if you want to update
1537                   automatically generated files; add new error codes or add new
1538                   (or change the visibility of) public API functions. (Unix only).
1539
1540Running Selected Tests
1541----------------------
1542
1543You can specify a set of tests to be performed
1544using the `make` variable `TESTS`.
1545
1546See the section [Running Selected Tests of
1547test/README.md](test/README.md#running-selected-tests).
1548
1549Troubleshooting
1550===============
1551
1552Configuration Problems
1553----------------------
1554
1555### Selecting the correct target
1556
1557The `./Configure` script tries hard to guess your operating system, but in some
1558cases it does not succeed. You will see a message like the following:
1559
1560    $ ./Configure
1561    Operating system: x86-whatever-minix
1562    This system (minix) is not supported. See file INSTALL.md for details.
1563
1564Even if the automatic target selection by the `./Configure` script fails,
1565chances are that you still might find a suitable target in the `Configurations`
1566directory, which you can supply to the `./Configure` command,
1567possibly after some adjustment.
1568
1569The `Configurations/` directory contains a lot of examples of such targets.
1570The main configuration file is [10-main.conf], which contains all targets that
1571are officially supported by the OpenSSL team. Other configuration files contain
1572targets contributed by other OpenSSL users. The list of targets can be found in
1573a Perl list `my %targets = ( ... )`.
1574
1575    my %targets = (
1576    ...
1577    "target-name" => {
1578        inherit_from     => [ "base-target" ],
1579        CC               => "...",
1580        cflags           => add("..."),
1581        asm_arch         => '...',
1582        perlasm_scheme   => "...",
1583    },
1584    ...
1585    )
1586
1587If you call `./Configure` without arguments, it will give you a list of all
1588known targets. Using `grep`, you can lookup the target definition in the
1589`Configurations/` directory. For example the `android-x86_64` can be found in
1590[Configurations/15-android.conf](Configurations/15-android.conf).
1591
1592The directory contains two README files, which explain the general syntax and
1593design of the configuration files.
1594
1595 - [Configurations/README.md](Configurations/README.md)
1596 - [Configurations/README-design.md](Configurations/README-design.md)
1597
1598If you need further help, try to search the [openssl-users] mailing list
1599or the [GitHub Issues] for existing solutions. If you don't find anything,
1600you can [raise an issue] to ask a question yourself.
1601
1602More about our support resources can be found in the [SUPPORT] file.
1603
1604### Configuration Errors
1605
1606If the `./Configure` or `./Configure` command fails with an error message,
1607read the error message carefully and try to figure out whether you made
1608a mistake (e.g., by providing a wrong option), or whether the script is
1609working incorrectly. If you think you encountered a bug, please
1610[raise an issue] on GitHub to file a bug report.
1611
1612Along with a short description of the bug, please provide the complete
1613configure command line and the relevant output including the error message.
1614
1615Note: To make the output readable, pleace add a 'code fence' (three backquotes
1616` ``` ` on a separate line) before and after your output:
1617
1618     ```
1619     ./Configure [your arguments...]
1620
1621     [output...]
1622
1623     ```
1624
1625Build Failures
1626--------------
1627
1628If the build fails, look carefully at the output. Try to locate and understand
1629the error message. It might be that the compiler is already telling you
1630exactly what you need to do to fix your problem.
1631
1632There may be reasons for the failure that aren't problems in OpenSSL itself,
1633for example if the compiler reports missing standard or third party headers.
1634
1635If the build succeeded previously, but fails after a source or configuration
1636change, it might be helpful to clean the build tree before attempting another
1637build.  Use this command:
1638
1639    $ make clean                                     # Unix
1640    $ mms clean                                      ! (or mmk) OpenVMS
1641    $ nmake clean                                    # Windows
1642
1643Assembler error messages can sometimes be sidestepped by using the `no-asm`
1644configuration option. See also [notes](#notes-on-assembler-modules-compilation).
1645
1646Compiling parts of OpenSSL with gcc and others with the system compiler will
1647result in unresolved symbols on some systems.
1648
1649If you are still having problems, try to search the [openssl-users] mailing
1650list or the [GitHub Issues] for existing solutions. If you think you
1651encountered an OpenSSL bug, please [raise an issue] to file a bug report.
1652Please take the time to review the existing issues first; maybe the bug was
1653already reported or has already been fixed.
1654
1655Test Failures
1656-------------
1657
1658If some tests fail, look at the output.  There may be reasons for the failure
1659that isn't a problem in OpenSSL itself (like an OS malfunction or a Perl issue).
1660
1661You may want increased verbosity, that can be accomplished as described in
1662section [Test Failures of test/README.md](test/README.md#test-failures).
1663
1664You may also want to selectively specify which test(s) to perform. This can be
1665done using the `make` variable `TESTS` as described in section [Running
1666Selected Tests of test/README.md](test/README.md#running-selected-tests).
1667
1668If you find a problem with OpenSSL itself, try removing any
1669compiler optimization flags from the `CFLAGS` line in the Makefile and
1670run `make clean; make` or corresponding.
1671
1672To report a bug please open an issue on GitHub, at
1673<https://github.com/openssl/openssl/issues>.
1674
1675Notes
1676=====
1677
1678Notes on multi-threading
1679------------------------
1680
1681For some systems, the OpenSSL `Configure` script knows what compiler options
1682are needed to generate a library that is suitable for multi-threaded
1683applications.  On these systems, support for multi-threading is enabled
1684by default; use the `no-threads` option to disable (this should never be
1685necessary).
1686
1687On other systems, to enable support for multi-threading, you will have
1688to specify at least two options: `threads`, and a system-dependent option.
1689(The latter is `-D_REENTRANT` on various systems.)  The default in this
1690case, obviously, is not to include support for multi-threading (but
1691you can still use `no-threads` to suppress an annoying warning message
1692from the `Configure` script.)
1693
1694OpenSSL provides built-in support for two threading models: pthreads (found on
1695most UNIX/Linux systems), and Windows threads.  No other threading models are
1696supported.  If your platform does not provide pthreads or Windows threads then
1697you should use `Configure` with the `no-threads` option.
1698
1699For pthreads, all locks are non-recursive. In addition, in a debug build,
1700the mutex attribute `PTHREAD_MUTEX_ERRORCHECK` is used. If this is not
1701available on your platform, you might have to add
1702`-DOPENSSL_NO_MUTEX_ERRORCHECK` to your `Configure` invocation.
1703(On Linux `PTHREAD_MUTEX_ERRORCHECK` is an enum value, so a built-in
1704ifdef test cannot be used.)
1705
1706Notes on shared libraries
1707-------------------------
1708
1709For most systems the OpenSSL `Configure` script knows what is needed to
1710build shared libraries for libcrypto and libssl.  On these systems
1711the shared libraries will be created by default.  This can be suppressed and
1712only static libraries created by using the `no-shared` option.  On systems
1713where OpenSSL does not know how to build shared libraries the `no-shared`
1714option will be forced and only static libraries will be created.
1715
1716Shared libraries are named a little differently on different platforms.
1717One way or another, they all have the major OpenSSL version number as
1718part of the file name, i.e.  for OpenSSL 1.1.x, `1.1` is somehow part of
1719the name.
1720
1721On most POSIX platforms, shared libraries are named `libcrypto.so.1.1`
1722and `libssl.so.1.1`.
1723
1724on Cygwin, shared libraries are named `cygcrypto-1.1.dll` and `cygssl-1.1.dll`
1725with import libraries `libcrypto.dll.a` and `libssl.dll.a`.
1726
1727On Windows build with MSVC or using MingW, shared libraries are named
1728`libcrypto-1_1.dll` and `libssl-1_1.dll` for 32-bit Windows,
1729`libcrypto-1_1-x64.dll` and `libssl-1_1-x64.dll` for 64-bit x86_64 Windows,
1730and `libcrypto-1_1-ia64.dll` and `libssl-1_1-ia64.dll` for IA64 Windows.
1731With MSVC, the import libraries are named `libcrypto.lib` and `libssl.lib`,
1732while with MingW, they are named `libcrypto.dll.a` and `libssl.dll.a`.
1733
1734On VMS, shareable images (VMS speak for shared libraries) are named
1735`ossl$libcrypto0101_shr.exe` and `ossl$libssl0101_shr.exe`.  However, when
1736OpenSSL is specifically built for 32-bit pointers, the shareable images
1737are named `ossl$libcrypto0101_shr32.exe` and `ossl$libssl0101_shr32.exe`
1738instead, and when built for 64-bit pointers, they are named
1739`ossl$libcrypto0101_shr64.exe` and `ossl$libssl0101_shr64.exe`.
1740
1741Notes on random number generation
1742---------------------------------
1743
1744Availability of cryptographically secure random numbers is required for
1745secret key generation.  OpenSSL provides several options to seed the
1746internal CSPRNG.  If not properly seeded, the internal CSPRNG will refuse
1747to deliver random bytes and a "PRNG not seeded error" will occur.
1748
1749The seeding method can be configured using the `--with-rand-seed` option,
1750which can be used to specify a comma separated list of seed methods.
1751However, in most cases OpenSSL will choose a suitable default method,
1752so it is not necessary to explicitly provide this option.  Note also
1753that not all methods are available on all platforms.  The FIPS provider will
1754silently ignore seed sources that were not validated.
1755
1756I) On operating systems which provide a suitable randomness source (in
1757form  of a system call or system device), OpenSSL will use the optimal
1758available  method to seed the CSPRNG from the operating system's
1759randomness sources.  This corresponds to the option `--with-rand-seed=os`.
1760
1761II) On systems without such a suitable randomness source, automatic seeding
1762and reseeding is disabled (`--with-rand-seed=none`) and it may be necessary
1763to install additional support software to obtain a random seed and reseed
1764the CSPRNG manually.  Please check out the manual pages for `RAND_add()`,
1765`RAND_bytes()`, `RAND_egd()`, and the FAQ for more information.
1766
1767Notes on assembler modules compilation
1768--------------------------------------
1769
1770Compilation of some code paths in assembler modules might depend on whether the
1771current assembler version supports certain ISA extensions or not. Code paths
1772that use the AES-NI, PCLMULQDQ, SSSE3, and SHA extensions are always assembled.
1773Apart from that, the minimum requirements for the assembler versions are shown
1774in the table below:
1775
1776| ISA extension | GNU as | nasm   | llvm    |
1777|---------------|--------|--------|---------|
1778| AVX           | 2.19   | 2.09   | 3.0     |
1779| AVX2          | 2.22   | 2.10   | 3.1     |
1780| ADCX/ADOX     | 2.23   | 2.10   | 3.3     |
1781| AVX512        | 2.25   | 2.11.8 | 3.6 (*) |
1782| AVX512IFMA    | 2.26   | 2.11.8 | 6.0 (*) |
1783| VAES          | 2.30   | 2.13.3 | 6.0 (*) |
1784
1785---
1786
1787(*) Even though AVX512 support was implemented in llvm 3.6, prior to version 7.0
1788an explicit -march flag was apparently required to compile assembly modules. But
1789then the compiler generates processor-specific code, which in turn contradicts
1790the idea of performing dispatch at run-time, which is facilitated by the special
1791variable `OPENSSL_ia32cap`. For versions older than 7.0, it is possible to work
1792around the problem by forcing the build procedure to use the following script:
1793
1794    #!/bin/sh
1795    exec clang -no-integrated-as "$@"
1796
1797instead of the real clang. In which case it doesn't matter what clang version
1798is used, as it is the version of the GNU assembler that will be checked.
1799
1800---
1801
1802<!-- Links  -->
1803
1804[openssl-users]:
1805    <https://mta.openssl.org/mailman/listinfo/openssl-users>
1806
1807[SUPPORT]:
1808    ./SUPPORT.md
1809
1810[GitHub Issues]:
1811    <https://github.com/openssl/openssl/issues>
1812
1813[raise an issue]:
1814    <https://github.com/openssl/openssl/issues/new/choose>
1815
1816[10-main.conf]:
1817    Configurations/10-main.conf
1818