path: root/INSTALL

 OPENSSL INSTALLATION
 --------------------

 This document describes installation on all supported operating
 systems (the Unix/Linux family (which includes Mac OS/X), OpenVMS,
 and Windows).

 To install OpenSSL, you will need:

  * A make implementation
  * Perl 5 with core modules (please read NOTES.PERL)
  * The perl module Text::Template (please read NOTES.PERL)
  * an ANSI C compiler
  * a development environment in the form of development libraries and C
    header files
  * a supported operating system

 For additional platform specific requirements, solutions to specific
 issues and other details, please read one of these:

  * NOTES.UNIX (any supported Unix like system)
  * NOTES.VMS (OpenVMS)
  * NOTES.WIN (any supported Windows)
  * NOTES.DJGPP (DOS platform with DJGPP)
  * NOTES.ANDROID (obviously Android [NDK])

 Notational conventions in this document
 ---------------------------------------

 Throughout this document, we use the following conventions in command
 examples:

 $ command                      Any line starting with a dollar sign
                                ($) is a command line.

 { word1 | word2 | word3 }      This denotes a mandatory choice, to be
                                replaced with one of the given words.
                                A simple example would be this:

                                $ echo { FOO | BAR | COOKIE }

                                which is to be understood as one of
                                these:

                                $ echo FOO
                                - or -
                                $ echo BAR
                                - or -
                                $ echo COOKIE

 [ word1 | word2 | word3 ]      Similar to { word1 | word2 | word3 }
                                except it's optional to give any of
                                those.  In addition to the examples
                                above, this would also be valid:

                                $ echo

 {{ target }}                   This denotes a mandatory word or
                                sequence of words of some sort.  A
                                simple example would be this:

                                $ type {{ filename }}

                                which is to be understood to use the
                                command 'type' on some file name
                                determined by the user.

 [[ options ]]                  Similar to {{ target }}, but is
                                optional.

 Note that the notation assumes spaces around {, }, [, ], {{, }} and
 [[, ]].  This is to differentiate from OpenVMS directory
 specifications, which also use [ and ], but without spaces.

 Quick Start
 -----------

 If you want to just get on with it, do:

  on Unix (again, this includes Mac OS/X):

    $ ./config
    $ make
    $ make test
    $ make install

  on OpenVMS:

    $ @config
    $ mms
    $ mms test
    $ mms install

  on Windows (only pick one of the targets for configuration):

    $ perl Configure { VC-WIN32 | VC-WIN64A | VC-WIN64I | VC-CE }
    $ nmake
    $ nmake test
    $ nmake install

 If any of these steps fails, see section Installation in Detail below.

 This will build and install OpenSSL in the default location, which is:

  Unix:    normal installation directories under /usr/local
  OpenVMS: SYS$COMMON:[OPENSSL-'version'...], where 'version' is the
           OpenSSL version number with underscores instead of periods.
  Windows: C:\Program Files\OpenSSL or C:\Program Files (x86)\OpenSSL

 If you want to install it anywhere else, run config like this:

  On Unix:

    $ ./config --prefix=/opt/openssl --openssldir=/usr/local/ssl

  On OpenVMS:

    $ @config --prefix=PROGRAM:[INSTALLS] --openssldir=SYS$MANAGER:[OPENSSL]

 (Note: if you do add options to the configuration command, please make sure
 you've read more than just this Quick Start, such as relevant NOTES.* files,
 the options outline below, as configuration options may change the outcome
 in otherwise unexpected ways)


 Configuration Options
 ---------------------

 There are several options to ./config (or ./Configure) to customize
 the build (note that for Windows, the defaults for --prefix and
 --openssldir depend in what configuration is used and what Windows
 implementation OpenSSL is built on.  More notes on this in NOTES.WIN):

  --api=x.y.z
                   Don't build with support for deprecated APIs below the
                   specified version number. For example "--api=1.1.0" will
                   remove support for all APIS that were deprecated in OpenSSL
                   version 1.1.0 or below.

  --cross-compile-prefix=PREFIX
                   The PREFIX to include in front of commands for your
                   toolchain. It's likely to have to end with dash, e.g.
                   a-b-c- would invoke GNU compiler as a-b-c-gcc, etc.
                   Unfortunately cross-compiling is too case-specific to
                   put together one-size-fits-all instructions. You might
                   have to pass more flags or set up environment variables
                   to actually make it work. Android and iOS cases are
                   discussed in corresponding Configurations/15-*.conf
                   files. But there are cases when this option alone is
                   sufficient. For example to build the mingw64 target on
                   Linux "--cross-compile-prefix=x86_64-w64-mingw32-"
                   works. Naturally provided that mingw packages are
                   installed. Today Debian and Ubuntu users have option to
                   install a number of prepackaged cross-compilers along
                   with corresponding run-time and development packages for
                   "alien" hardware. To give another example
                   "--cross-compile-prefix=mipsel-linux-gnu-" suffices
                   in such case. Needless to mention that you have to
                   invoke ./Configure, not ./config, and pass your target
                   name explicitly. Also, note that --openssldir refers
                   to target's file system, not one you are building on.

  --debug
                   Build OpenSSL with debugging symbols and zero optimization
                   level.

  --libdir=DIR
                   The name of the directory under the top of the installation
                   directory tree (see the --prefix option) where libraries will
                   be installed. By default this is "lib". Note that on Windows
                   only ".lib" files will be stored in this location. dll files
                   will always be installed to the "bin" directory.

  --openssldir=DIR
                   Directory for OpenSSL configuration files, and also the
                   default certificate and key store.  Defaults are:

                   Unix:           /usr/local/ssl
                   Windows:        C:\Program Files\Common Files\SSL
                                or C:\Program Files (x86)\Common Files\SSL
                   OpenVMS:        SYS$COMMON:[OPENSSL-COMMON]

  --prefix=DIR
                   The top of the installation directory tree.  Defaults are:

                   Unix:           /usr/local
                   Windows:        C:\Program Files\OpenSSL
                                or C:\Program Files (x86)\OpenSSL
                   OpenVMS:        SYS$COMMON:[OPENSSL-'version']

  --release
                   Build OpenSSL without debugging symbols. This is the default.

  --strict-warnings
                   This is a developer flag that switches on various compiler
                   options recommended for OpenSSL development. It only works
                   when using gcc or clang as the compiler. If you are
                   developing a patch for OpenSSL then it is recommended that
                   you use this option where possible.

  --with-zlib-include=DIR
                   The directory for the location of the zlib include file. This
                   option is only necessary if enable-zlib (see below) is used
                   and the include file is not already on the system include
                   path.

  --with-zlib-lib=LIB
                   On Unix: this is the directory containing the zlib library.
                   If not provided the system library path will be used.
                   On Windows: this is the filename of the zlib library (with or
                   without a path). This flag must be provided if the
                   zlib-dynamic option is not also used. If zlib-dynamic is used
                   then this flag is optional and a default value ("ZLIB1") is
                   used if not provided.
                   On VMS: this is the filename of the zlib library (with or
                   without a path). This flag is optional and if not provided
                   then "GNV$LIBZSHR", "GNV$LIBZSHR32" or "GNV$LIBZSHR64" is
                   used by default depending on the pointer size chosen.


  --with-rand-seed=seed1[,seed2,...]
                   A comma separated list of seeding methods which will be tried
                   by OpenSSL in order to obtain random input (a.k.a "entropy")
                   for seeding its cryptographically secure random number
                   generator (CSPRNG). The current seeding methods are:

                   os:         Use a trusted operating system entropy source.
                               This is the default method if such an entropy
                               source exists.
                   getrandom:  Use the L<getrandom(2)> or equivalent system
                               call.
                   devrandom:  Use the the first device from the DEVRANDOM list
                               which can be opened to read random bytes. The
                               DEVRANDOM preprocessor constant expands to
                               "/dev/urandom","/dev/random","/dev/srandom" on
                               most unix-ish operating systems.
                   egd:        Check for an entropy generating daemon.
                   rdcpu:      Use the RDSEED or RDRAND command if provided by
                               the CPU.
                   librandom:  Use librandom (not implemented yet).
                   none:       Disable automatic seeding. This is the default
                               on some operating systems where no suitable
                               entropy source exists, or no support for it is
                               implemented yet.

                   For more information, see the section 'Note on random number
                   generation' at the end of this document.

  no-afalgeng
                   Don't build the AFALG engine. This option will be forced if
                   on a platform that does not support AFALG.

  enable-asan
                   Build with the Address sanitiser. This is a developer option
                   only. It may not work on all platforms and should never be
                   used in production environments. It will only work when used
                   with gcc or clang and should be used in conjunction with the
                   no-shared option.

  no-asm
                   Do not use assembler code. This should be viewed as
                   debugging/trouble-shooting option rather than production.
                   On some platforms a small amount of assembler code may
                   still be used even with this option.

  no-async
                   Do not build support for async operations.

  no-autoalginit
                   Don't automatically load all supported ciphers and digests.
                   Typically OpenSSL will make available all of its supported
                   ciphers and digests. For a statically linked application this
                   may be undesirable if small executable size is an objective.
                   This only affects libcrypto. Ciphers a