VirtualBox

source: vbox/trunk/src/libs/openssl-3.0.3/INSTALL.md@ 96686

Last change on this file since 96686 was 94320, checked in by vboxsync, 3 years ago

libs/openssl-3.0.1: Export to OSE and fix copyright headers in Makefiles, bugref:10128

File size: 61.1 KB
Line 
1Build and Install
2=================
3
4This document describes installation on all supported operating
5systems (the Unix/Linux family, including macOS), OpenVMS,
6and Windows).
7
8Table of Contents
9=================
10
11 - [Prerequisites](#prerequisites)
12 - [Notational Conventions](#notational-conventions)
13 - [Quick Installation Guide](#quick-installation-guide)
14 - [Building OpenSSL](#building-openssl)
15 - [Installing OpenSSL](#installing-openssl)
16 - [Configuration Options](#configuration-options)
17 - [API Level](#api-level)
18 - [Cross Compile Prefix](#cross-compile-prefix)
19 - [Build Type](#build-type)
20 - [Directories](#directories)
21 - [Compiler Warnings](#compiler-warnings)
22 - [ZLib Flags](#zlib-flags)
23 - [Seeding the Random Generator](#seeding-the-random-generator)
24 - [Setting the FIPS HMAC key](#setting-the-FIPS-HMAC-key)
25 - [Enable and Disable Features](#enable-and-disable-features)
26 - [Displaying configuration data](#displaying-configuration-data)
27 - [Installation Steps in Detail](#installation-steps-in-detail)
28 - [Configure](#configure-openssl)
29 - [Build](#build-openssl)
30 - [Test](#test-openssl)
31 - [Install](#install-openssl)
32 - [Advanced Build Options](#advanced-build-options)
33 - [Environment Variables](#environment-variables)
34 - [Makefile Targets](#makefile-targets)
35 - [Running Selected Tests](#running-selected-tests)
36 - [Troubleshooting](#troubleshooting)
37 - [Configuration Problems](#configuration-problems)
38 - [Build Failures](#build-failures)
39 - [Test Failures](#test-failures)
40 - [Notes](#notes)
41 - [Notes on multi-threading](#notes-on-multi-threading)
42 - [Notes on shared libraries](#notes-on-shared-libraries)
43 - [Notes on random number generation](#notes-on-random-number-generation)
44 - [Notes on assembler modules compilation](#notes-on-assembler-modules-compilation)
45
46Prerequisites
47=============
48
49To install OpenSSL, you will need:
50
51 * A "make" implementation
52 * Perl 5 with core modules (please read [NOTES-PERL.md](NOTES-PERL.md))
53 * The Perl module `Text::Template` (please read [NOTES-PERL.md](NOTES-PERL.md))
54 * an ANSI C compiler
55 * a development environment in the form of development libraries and C
56 header files
57 * a supported operating system
58
59For additional platform specific requirements, solutions to specific
60issues and other details, please read one of these:
61
62 * [Notes for UNIX-like platforms](NOTES-UNIX.md)
63 * [Notes for Android platforms](NOTES-ANDROID.md)
64 * [Notes for Windows platforms](NOTES-WINDOWS.md)
65 * [Notes for the DOS platform with DJGPP](NOTES-DJGPP.md)
66 * [Notes for the OpenVMS platform](NOTES-VMS.md)
67 * [Notes on Perl](NOTES-PERL.md)
68 * [Notes on Valgrind](NOTES-VALGRIND.md)
69
70Notational conventions
71======================
72
73Throughout this document, we use the following conventions.
74
75Commands
76--------
77
78Any line starting with a dollar sign is a command line.
79
80 $ command
81
82The dollar sign indicates the shell prompt and is not to be entered as
83part of the command.
84
85Choices
86-------
87
88Several words in curly braces separated by pipe characters indicate a
89**mandatory choice**, to be replaced with one of the given words.
90For example, the line
91
92 $ echo { WORD1 | WORD2 | WORD3 }
93
94represents one of the following three commands
95
96 $ echo WORD1
97 - or -
98 $ echo WORD2
99 - or -
100 $ echo WORD3
101
102One or several words in square brackets separated by pipe characters
103denote an **optional choice**. It is similar to the mandatory choice,
104but it can also be omitted entirely.
105
106So the line
107
108 $ echo [ WORD1 | WORD2 | WORD3 ]
109
110represents one of the four commands
111
112 $ echo WORD1
113 - or -
114 $ echo WORD2
115 - or -
116 $ echo WORD3
117 - or -
118 $ echo
119
120Arguments
121---------
122
123**Mandatory arguments** are enclosed in double curly braces.
124A simple example would be
125
126 $ type {{ filename }}
127
128which is to be understood to use the command `type` on some file name
129determined by the user.
130
131**Optional Arguments** are enclosed in double square brackets.
132
133 [[ options ]]
134
135Note that the notation assumes spaces around `{`, `}`, `[`, `]`, `{{`, `}}` and
136`[[`, `]]`. This is to differentiate from OpenVMS directory
137specifications, which also use [ and ], but without spaces.
138
139Quick Installation Guide
140========================
141
142If you just want to get OpenSSL installed without bothering too much
143about the details, here is the short version of how to build and install
144OpenSSL. If any of the following steps fails, please consult the
145[Installation in Detail](#installation-steps-in-detail) section below.
146
147Building OpenSSL
148----------------
149
150Use the following commands to configure, build and test OpenSSL.
151The testing is optional, but recommended if you intend to install
152OpenSSL for production use.
153
154### Unix / Linux / macOS
155
156 $ ./Configure
157 $ make
158 $ make test
159
160### OpenVMS
161
162Use the following commands to build OpenSSL:
163
164 $ perl Configure
165 $ mms
166 $ mms test
167
168### Windows
169
170If you are using Visual Studio, open a Developer Command Prompt and
171issue the following commands to build OpenSSL.
172
173 $ perl Configure
174 $ nmake
175 $ nmake test
176
177As mentioned in the [Choices](#choices) section, you need to pick one
178of the four Configure targets in the first command.
179
180Most likely you will be using the `VC-WIN64A` target for 64bit Windows
181binaries (AMD64) or `VC-WIN32` for 32bit Windows binaries (X86).
182The other two options are `VC-WIN64I` (Intel IA64, Itanium) and
183`VC-CE` (Windows CE) are rather uncommon nowadays.
184
185Installing OpenSSL
186------------------
187
188The following commands will install OpenSSL to a default system location.
189
190**Danger Zone:** even if you are impatient, please read the following two
191paragraphs carefully before you install OpenSSL.
192
193For security reasons the default system location is by default not writable
194for unprivileged users. So for the final installation step administrative
195privileges are required. The default system location and the procedure to
196obtain administrative privileges depends on the operating system.
197It is recommended to compile and test OpenSSL with normal user privileges
198and use administrative privileges only for the final installation step.
199
200On some platforms OpenSSL is preinstalled as part of the Operating System.
201In this case it is highly recommended not to overwrite the system versions,
202because other applications or libraries might depend on it.
203To avoid breaking other applications, install your copy of OpenSSL to a
204[different location](#installing-to-a-different-location) which is not in
205the global search path for system libraries.
206
207Finally, if you plan on using the FIPS module, you need to read the
208[Post-installation Notes](#post-installation-notes) further down.
209
210### Unix / Linux / macOS
211
212Depending on your distribution, you need to run the following command as
213root user or prepend `sudo` to the command:
214
215 $ make install
216
217By default, OpenSSL will be installed to
218
219 /usr/local
220
221More precisely, the files will be installed into the subdirectories
222
223 /usr/local/bin
224 /usr/local/lib
225 /usr/local/include
226 ...
227
228depending on the file type, as it is custom on Unix-like operating systems.
229
230### OpenVMS
231
232Use the following command to install OpenSSL.
233
234 $ mms install
235
236By default, OpenSSL will be installed to
237
238 SYS$COMMON:[OPENSSL]
239
240### Windows
241
242If you are using Visual Studio, open the Developer Command Prompt _elevated_
243and issue the following command.
244
245 $ nmake install
246
247The easiest way to elevate the Command Prompt is to press and hold down
248the both the `<CTRL>` and `<SHIFT>` key while clicking the menu item in the
249task menu.
250
251The default installation location is
252
253 C:\Program Files\OpenSSL
254
255for native binaries, or
256
257 C:\Program Files (x86)\OpenSSL
258
259for 32bit binaries on 64bit Windows (WOW64).
260
261#### Installing to a different location
262
263To install OpenSSL to a different location (for example into your home
264directory for testing purposes) run `Configure` as shown in the following
265examples.
266
267The options `--prefix` and `--openssldir` are explained in further detail in
268[Directories](#directories) below, and the values used here are mere examples.
269
270On Unix:
271
272 $ ./Configure --prefix=/opt/openssl --openssldir=/usr/local/ssl
273
274On OpenVMS:
275
276 $ perl Configure --prefix=PROGRAM:[INSTALLS] --openssldir=SYS$MANAGER:[OPENSSL]
277
278Note: if you do add options to the configuration command, please make sure
279you've read more than just this Quick Start, such as relevant `NOTES-*` files,
280the options outline below, as configuration options may change the outcome
281in otherwise unexpected ways.
282
283Configuration Options
284=====================
285
286There are several options to `./Configure` to customize the build (note that
287for Windows, the defaults for `--prefix` and `--openssldir` depend on what
288configuration is used and what Windows implementation OpenSSL is built on.
289For more information, see the [Notes for Windows platforms](NOTES-WINDOWS.md).
290
291API Level
292---------
293
294 --api=x.y[.z]
295
296Build the OpenSSL libraries to support the API for the specified version.
297If [no-deprecated](#no-deprecated) is also given, don't build with support
298for deprecated APIs in or below the specified version number. For example,
299adding
300
301 --api=1.1.0 no-deprecated
302
303will remove support for all APIs that were deprecated in OpenSSL version
3041.1.0 or below. This is a rather specialized option for developers.
305If you just intend to remove all deprecated APIs up to the current version
306entirely, just specify [no-deprecated](#no-deprecated).
307If `--api` isn't given, it defaults to the current (minor) OpenSSL version.
308
309Cross Compile Prefix
310--------------------
311
312 --cross-compile-prefix=<PREFIX>
313
314The `<PREFIX>` to include in front of commands for your toolchain.
315
316It is likely to have to end with dash, e.g. `a-b-c-` would invoke GNU compiler
317as `a-b-c-gcc`, etc. Unfortunately cross-compiling is too case-specific to put
318together one-size-fits-all instructions. You might have to pass more flags or
319set up environment variables to actually make it work. Android and iOS cases
320are discussed in corresponding `Configurations/15-*.conf` files. But there are
321cases when this option alone is sufficient. For example to build the mingw64
322target on Linux `--cross-compile-prefix=x86_64-w64-mingw32-` works. Naturally
323provided that mingw packages are installed. Today Debian and Ubuntu users
324have option to install a number of prepackaged cross-compilers along with
325corresponding run-time and development packages for "alien" hardware. To give
326another example `--cross-compile-prefix=mipsel-linux-gnu-` suffices in such
327case.
328
329For cross compilation, you must [configure manually](#manual-configuration).
330Also, note that `--openssldir` refers to target's file system, not one you are
331building on.
332
333Build Type
334----------
335
336 --debug
337
338Build OpenSSL with debugging symbols and zero optimization level.
339
340 --release
341
342Build OpenSSL without debugging symbols. This is the default.
343
344Directories
345-----------
346
347### libdir
348
349 --libdir=DIR
350
351The name of the directory under the top of the installation directory tree
352(see the `--prefix` option) where libraries will be installed. By default
353this is `lib`. Note that on Windows only static libraries (`*.lib`) will
354be stored in this location. Shared libraries (`*.dll`) will always be
355installed to the `bin` directory.
356
357Some build targets have a multilib postfix set in the build configuration.
358For these targets the default libdir is `lib<multilib-postfix>`. Please use
359`--libdir=lib` to override the libdir if adding the postfix is undesirable.
360
361### openssldir
362
363 --openssldir=DIR
364
365Directory for OpenSSL configuration files, and also the default certificate
366and key store. Defaults are:
367
368 Unix: /usr/local/ssl
369 Windows: C:\Program Files\Common Files\SSL
370 OpenVMS: SYS$COMMON:[OPENSSL-COMMON]
371
372For 32bit Windows applications on Windows 64bit (WOW64), always replace
373`C:\Program Files` by `C:\Program Files (x86)`.
374
375### prefix
376
377 --prefix=DIR
378
379The top of the installation directory tree. Defaults are:
380
381 Unix: /usr/local
382 Windows: C:\Program Files\OpenSSL
383 OpenVMS: SYS$COMMON:[OPENSSL]
384
385Compiler Warnings
386-----------------
387
388 --strict-warnings
389
390This is a developer flag that switches on various compiler options recommended
391for OpenSSL development. It only works when using gcc or clang as the compiler.
392If you are developing a patch for OpenSSL then it is recommended that you use
393this option where possible.
394
395ZLib Flags
396----------
397
398### with-zlib-include
399
400 --with-zlib-include=DIR
401
402The directory for the location of the zlib include file. This option is only
403necessary if [zlib](#zlib) is used and the include file is not
404already on the system include path.
405
406### with-zlib-lib
407
408 --with-zlib-lib=LIB
409
410**On Unix**: this is the directory containing the zlib library.
411If not provided the system library path will be used.
412
413**On Windows:** this is the filename of the zlib library (with or
414without a path). This flag must be provided if the
415[zlib-dynamic](#zlib-dynamic) option is not also used. If `zlib-dynamic` is used
416then this flag is optional and defaults to `ZLIB1` if not provided.
417
418**On VMS:** this is the filename of the zlib library (with or without a path).
419This flag is optional and if not provided then `GNV$LIBZSHR`, `GNV$LIBZSHR32`
420or `GNV$LIBZSHR64` is used by default depending on the pointer size chosen.
421
422Seeding the Random Generator
423----------------------------
424
425 --with-rand-seed=seed1[,seed2,...]
426
427A comma separated list of seeding methods which will be tried by OpenSSL
428in order to obtain random input (a.k.a "entropy") for seeding its
429cryptographically secure random number generator (CSPRNG).
430The current seeding methods are:
431
432### os
433
434Use a trusted operating system entropy source.
435This is the default method if such an entropy source exists.
436
437### getrandom
438
439Use the [getrandom(2)][man-getrandom] or equivalent system call.
440
441[man-getrandom]: http://man7.org/linux/man-pages/man2/getrandom.2.html
442
443### devrandom
444
445Use the first device from the `DEVRANDOM` list which can be opened to read
446random bytes. The `DEVRANDOM` preprocessor constant expands to
447
448 "/dev/urandom","/dev/random","/dev/srandom"
449
450on most unix-ish operating systems.
451
452### egd
453
454Check for an entropy generating daemon.
455This source is ignored by the FIPS provider.
456
457### rdcpu
458
459Use the `RDSEED` or `RDRAND` command if provided by the CPU.
460
461### librandom
462
463Use librandom (not implemented yet).
464This source is ignored by the FIPS provider.
465
466### none
467
468Disable automatic seeding. This is the default on some operating systems where
469no suitable entropy source exists, or no support for it is implemented yet.
470This option is ignored by the FIPS provider.
471
472For more information, see the section [Notes on random number generation][rng]
473at the end of this document.
474
475[rng]: #notes-on-random-number-generation
476
477Setting the FIPS HMAC key
478-------------------------
479
480 --fips-key=value
481
482As part of its self-test validation, the FIPS module must verify itself
483by performing a SHA-256 HMAC computation on itself. The default key is
484the SHA256 value of "the holy handgrenade of antioch" and is sufficient
485for meeting the FIPS requirements.
486
487To change the key to a different value, use this flag. The value should
488be a hex string no more than 64 characters.
489
490Enable and Disable Features
491---------------------------
492
493Feature options always come in pairs, an option to enable feature
494`xxxx`, and an option to disable it:
495
496 [ enable-xxxx | no-xxxx ]
497
498Whether a feature is enabled or disabled by default, depends on the feature.
499In the following list, always the non-default variant is documented: if
500feature `xxxx` is disabled by default then `enable-xxxx` is documented and
501if feature `xxxx` is enabled by default then `no-xxxx` is documented.
502
503### no-afalgeng
504
505Don't build the AFALG engine.
506
507This option will be forced on a platform that does not support AFALG.
508
509### enable-ktls
510
511Build with Kernel TLS support.
512
513This option will enable the use of the Kernel TLS data-path, which can improve
514performance and allow for the use of sendfile and splice system calls on
515TLS sockets. The Kernel may use TLS accelerators if any are available on the
516system. This option will be forced off on systems that do not support the
517Kernel TLS data-path.
518
519### enable-asan
520
521Build with the Address sanitiser.
522
523This is a developer option only. It may not work on all platforms and should
524never be used in production environments. It will only work when used with
525gcc or clang and should be used in conjunction with the [no-shared](#no-shared)
526option.
527
528### enable-acvp-tests
529
530Build support for Automated Cryptographic Validation Protocol (ACVP)
531tests.
532
533This is required for FIPS validation purposes. Certain ACVP tests require
534access to algorithm internals that are not normally accessible.
535Additional information related to ACVP can be found at
536<https://github.com/usnistgov/ACVP>.
537
538### no-asm
539
540Do not use assembler code.
541
542This should be viewed as debugging/troubleshooting option rather than for
543production use. On some platforms a small amount of assembler code may still
544be used even with this option.
545
546### no-async
547
548Do not build support for async operations.
549
550### no-autoalginit
551
552Don't automatically load all supported ciphers and digests.
553
554Typically OpenSSL will make available all of its supported ciphers and digests.
555For a statically linked application this may be undesirable if small executable
556size is an objective. This only affects libcrypto. Ciphers and digests will
557have to be loaded manually using `EVP_add_cipher()` and `EVP_add_digest()`
558if this option is used. This option will force a non-shared build.
559
560### no-autoerrinit
561
562Don't automatically load all libcrypto/libssl error strings.
563
564Typically OpenSSL will automatically load human readable error strings. For a
565statically linked application this may be undesirable if small executable size
566is an objective.
567
568### no-autoload-config
569
570Don't automatically load the default `openssl.cnf` file.
571
572Typically OpenSSL will automatically load a system config file which configures
573default SSL options.
574
575### enable-buildtest-c++
576
577While testing, generate C++ buildtest files that simply check that the public
578OpenSSL header files are usable standalone with C++.
579
580Enabling this option demands extra care. For any compiler flag given directly
581as configuration option, you must ensure that it's valid for both the C and
582the C++ compiler. If not, the C++ build test will most likely break. As an
583alternative, you can use the language specific variables, `CFLAGS` and `CXXFLAGS`.
584
585### --banner=text
586
587Use the specified text instead of the default banner at the end of
588configuration.
589
590### --w
591
592On platforms where the choice of 32-bit or 64-bit architecture
593is not explicitly specified, `Configure` will print a warning
594message and wait for a few seconds to let you interrupt the
595configuration. Using this flag skips the wait.
596
597### no-bulk
598
599Build only some minimal set of features.
600This is a developer option used internally for CI build tests of the project.
601
602### no-cached-fetch
603
604Never cache algorithms when they are fetched from a provider. Normally, a
605provider indicates if the algorithms it supplies can be cached or not. Using
606this option will reduce run-time memory usage but it also introduces a
607significant performance penalty. This option is primarily designed to help
608with detecting incorrect reference counting.
609
610### no-capieng
611
612Don't build the CAPI engine.
613
614This option will be forced if on a platform that does not support CAPI.
615
616### no-cmp
617
618Don't build support for Certificate Management Protocol (CMP)
619and Certificate Request Message Format (CRMF).
620
621### no-cms
622
623Don't build support for Cryptographic Message Syntax (CMS).
624
625### no-comp
626
627Don't build support for SSL/TLS compression.
628
629If this option is enabled (the default), then compression will only work if
630the zlib or `zlib-dynamic` options are also chosen.
631
632### enable-crypto-mdebug
633
634This now only enables the `failed-malloc` feature.
635
636### enable-crypto-mdebug-backtrace
637
638This is a no-op; the project uses the compiler's address/leak sanitizer instead.
639
640### no-ct
641
642Don't build support for Certificate Transparency (CT).
643
644### no-deprecated
645
646Don't build with support for deprecated APIs up until and including the version
647given with `--api` (or the current version, if `--api` wasn't specified).
648
649### no-dgram
650
651Don't build support for datagram based BIOs.
652
653Selecting this option will also force the disabling of DTLS.
654
655### no-dso
656
657Don't build support for loading Dynamic Shared Objects (DSO)
658
659### enable-devcryptoeng
660
661Build the `/dev/crypto` engine.
662
663This option is automatically selected on the BSD platform, in which case it can
664be disabled with `no-devcryptoeng`.
665
666### no-dynamic-engine
667
668Don't build the dynamically loaded engines.
669
670This only has an effect in a shared build.
671
672### no-ec
673
674Don't build support for Elliptic Curves.
675
676### no-ec2m
677
678Don't build support for binary Elliptic Curves
679
680### enable-ec_nistp_64_gcc_128
681
682Enable support for optimised implementations of some commonly used NIST
683elliptic curves.
684
685This option is only supported on platforms:
686
687 - with little-endian storage of non-byte types
688 - that tolerate misaligned memory references
689 - where the compiler:
690 - supports the non-standard type `__uint128_t`
691 - defines the built-in macro `__SIZEOF_INT128__`
692
693### enable-egd
694
695Build support for gathering entropy from the Entropy Gathering Daemon (EGD).
696
697### no-engine
698
699Don't build support for loading engines.
700
701### no-err
702
703Don't compile in any error strings.
704
705### enable-external-tests
706
707Enable building of integration with external test suites.
708
709This is a developer option and may not work on all platforms. The following
710external test suites are currently supported:
711
712 - GOST engine test suite
713 - Python PYCA/Cryptography test suite
714 - krb5 test suite
715
716See the file [test/README-external.md](test/README-external.md)
717for further details.
718
719### no-filenames
720
721Don't compile in filename and line number information (e.g. for errors and
722memory allocation).
723
724### enable-fips
725
726Build (and install) the FIPS provider
727
728### no-fips-securitychecks
729
730Don't perform FIPS module run-time checks related to enforcement of security
731parameters such as minimum security strength of keys.
732
733### enable-fuzz-libfuzzer, enable-fuzz-afl
734
735Build with support for fuzzing using either libfuzzer or AFL.
736
737These are developer options only. They may not work on all platforms and
738should never be used in production environments.
739
740See the file [fuzz/README.md](fuzz/README.md) for further details.
741
742### no-gost
743
744Don't build support for GOST based ciphersuites.
745
746Note that if this feature is enabled then GOST ciphersuites are only available
747if the GOST algorithms are also available through loading an externally supplied
748engine.
749
750### no-legacy
751
752Don't build the legacy provider.
753
754Disabling this also disables the legacy algorithms: MD2 (already disabled by default).
755
756### no-makedepend
757
758Don't generate dependencies.
759
760### no-module
761
762Don't build any dynamically loadable engines.
763
764This also implies `no-dynamic-engine`.
765
766### no-multiblock
767
768Don't build support for writing multiple records in one go in libssl
769
770Note: this is a different capability to the pipelining functionality.
771
772### no-nextprotoneg
773
774Don't build support for the Next Protocol Negotiation (NPN) TLS extension.
775
776### no-ocsp
777
778Don't build support for Online Certificate Status Protocol (OCSP).
779
780### no-padlockeng
781
782Don't build the padlock engine.
783
784### no-hw-padlock
785
786As synonym for `no-padlockeng`. Deprecated and should not be used.
787
788### no-pic
789
790Don't build with support for Position Independent Code.
791
792### no-pinshared
793
794Don't pin the shared libraries.
795
796By default OpenSSL will attempt to stay in memory until the process exits.
797This is so that libcrypto and libssl can be properly cleaned up automatically
798via an `atexit()` handler. The handler is registered by libcrypto and cleans
799up both libraries. On some platforms the `atexit()` handler will run on unload of
800libcrypto (if it has been dynamically loaded) rather than at process exit. This
801option can be used to stop OpenSSL from attempting to stay in memory until the
802process exits. This could lead to crashes if either libcrypto or libssl have
803already been unloaded at the point that the atexit handler is invoked, e.g. on a
804platform which calls `atexit()` on unload of the library, and libssl is unloaded
805before libcrypto then a crash is likely to happen. Applications can suppress
806running of the `atexit()` handler at run time by using the
807`OPENSSL_INIT_NO_ATEXIT` option to `OPENSSL_init_crypto()`.
808See the man page for it for further details.
809
810### no-posix-io
811
812Don't use POSIX IO capabilities.
813
814### no-psk
815
816Don't build support for Pre-Shared Key based ciphersuites.
817
818### no-rdrand
819
820Don't use hardware RDRAND capabilities.
821
822### no-rfc3779
823
824Don't build support for RFC3779, "X.509 Extensions for IP Addresses and
825AS Identifiers".
826
827### sctp
828
829Build support for Stream Control Transmission Protocol (SCTP).
830
831### no-shared
832
833Do not create shared libraries, only static ones.
834
835See [Notes on shared libraries](#notes-on-shared-libraries) below.
836
837### no-sock
838
839Don't build support for socket BIOs.
840
841### no-srp
842
843Don't build support for Secure Remote Password (SRP) protocol or
844SRP based ciphersuites.
845
846### no-srtp
847
848Don't build Secure Real-Time Transport Protocol (SRTP) support.
849
850### no-sse2
851
852Exclude SSE2 code paths from 32-bit x86 assembly modules.
853
854Normally SSE2 extension is detected at run-time, but the decision whether or not
855the machine code will be executed is taken solely on CPU capability vector. This
856means that if you happen to run OS kernel which does not support SSE2 extension
857on Intel P4 processor, then your application might be exposed to "illegal
858instruction" exception. There might be a way to enable support in kernel, e.g.
859FreeBSD kernel can be compiled with `CPU_ENABLE_SSE`, and there is a way to
860disengage SSE2 code paths upon application start-up, but if you aim for wider
861"audience" running such kernel, consider `no-sse2`. Both the `386` and `no-asm`
862options imply `no-sse2`.
863
864### no-ssl-trace
865
866Don't build with SSL Trace capabilities.
867
868This removes the `-trace` option from `s_client` and `s_server`, and omits the
869`SSL_trace()` function from libssl.
870
871Disabling `ssl-trace` may provide a small reduction in libssl binary size.
872
873### no-static-engine
874
875Don't build the statically linked engines.
876
877This only has an impact when not built "shared".
878
879### no-stdio
880
881Don't use anything from the C header file `stdio.h` that makes use of the `FILE`
882type. Only libcrypto and libssl can be built in this way. Using this option will
883suppress building the command line applications. Additionally, since the OpenSSL
884tests also use the command line applications, the tests will also be skipped.
885
886### no-tests
887
888Don't build test programs or run any tests.
889
890### no-threads
891
892Don't build with support for multi-threaded applications.
893
894### threads
895
896Build with support for multi-threaded applications. Most platforms will enable
897this by default. However, if on a platform where this is not the case then this
898will usually require additional system-dependent options!
899
900See [Notes on multi-threading](#notes-on-multi-threading) below.
901
902### enable-trace
903
904Build with support for the integrated tracing api.
905
906See manual pages OSSL_trace_set_channel(3) and OSSL_trace_enabled(3) for details.
907
908### no-ts
909
910Don't build Time Stamping (TS) Authority support.
911
912### enable-ubsan
913
914Build with the Undefined Behaviour sanitiser (UBSAN).
915
916This is a developer option only. It may not work on all platforms and should
917never be used in production environments. It will only work when used with
918gcc or clang and should be used in conjunction with the `-DPEDANTIC` option
919(or the `--strict-warnings` option).
920
921### no-ui-console
922
923Don't build with the User Interface (UI) console method
924
925The User Interface console method enables text based console prompts.
926
927### enable-unit-test
928
929Enable additional unit test APIs.
930
931This should not typically be used in production deployments.
932
933### no-uplink
934
935Don't build support for UPLINK interface.
936
937### enable-weak-ssl-ciphers
938
939Build support for SSL/TLS ciphers that are considered "weak"
940
941Enabling this includes for example the RC4 based ciphersuites.
942
943### zlib
944
945Build with support for zlib compression/decompression.
946
947### zlib-dynamic
948
949Like the zlib option, but has OpenSSL load the zlib library dynamically
950when needed.
951
952This is only supported on systems where loading of shared libraries is supported.
953
954### 386
955
956In 32-bit x86 builds, use the 80386 instruction set only in assembly modules
957
958The default x86 code is more efficient, but requires at least an 486 processor.
959Note: This doesn't affect compiler generated code, so this option needs to be
960accompanied by a corresponding compiler-specific option.
961
962### no-{protocol}
963
964 no-{ssl|ssl3|tls|tls1|tls1_1|tls1_2|tls1_3|dtls|dtls1|dtls1_2}
965
966Don't build support for negotiating the specified SSL/TLS protocol.
967
968If `no-tls` is selected then all of `tls1`, `tls1_1`, `tls1_2` and `tls1_3`
969are disabled.
970Similarly `no-dtls` will disable `dtls1` and `dtls1_2`. The `no-ssl` option is
971synonymous with `no-ssl3`. Note this only affects version negotiation.
972OpenSSL will still provide the methods for applications to explicitly select
973the individual protocol versions.
974
975### no-{protocol}-method
976
977 no-{ssl|ssl3|tls|tls1|tls1_1|tls1_2|tls1_3|dtls|dtls1|dtls1_2}-method
978
979Analogous to `no-{protocol}` but in addition do not build the methods for
980applications to explicitly select individual protocol versions. Note that there
981is no `no-tls1_3-method` option because there is no application method for
982TLSv1.3.
983
984Using individual protocol methods directly is deprecated. Applications should
985use `TLS_method()` instead.
986
987### enable-{algorithm}
988
989 enable-{md2|rc5}
990
991Build with support for the specified algorithm.
992
993### no-{algorithm}
994
995 no-{aria|bf|blake2|camellia|cast|chacha|cmac|
996 des|dh|dsa|ecdh|ecdsa|idea|md4|mdc2|ocb|
997 poly1305|rc2|rc4|rmd160|scrypt|seed|
998 siphash|siv|sm2|sm3|sm4|whirlpool}
999
1000Build without support for the specified algorithm.
1001
1002The `ripemd` algorithm is deprecated and if used is synonymous with `rmd160`.
1003
1004### Compiler-specific options
1005
1006 -Dxxx, -Ixxx, -Wp, -lxxx, -Lxxx, -Wl, -rpath, -R, -framework, -static
1007
1008These system specific options will be recognised and passed through to the
1009compiler to allow you to define preprocessor symbols, specify additional
1010libraries, library directories or other compiler options. It might be worth
1011noting that some compilers generate code specifically for processor the
1012compiler currently executes on. This is not necessarily what you might have
1013in mind, since it might be unsuitable for execution on other, typically older,
1014processor. Consult your compiler documentation.
1015
1016Take note of the [Environment Variables](#environment-variables) documentation
1017below and how these flags interact with those variables.
1018
1019 -xxx, +xxx, /xxx
1020
1021Additional options that are not otherwise recognised are passed through as
1022they are to the compiler as well. Unix-style options beginning with a
1023`-` or `+` and Windows-style options beginning with a `/` are recognized.
1024Again, consult your compiler documentation.
1025
1026If the option contains arguments separated by spaces, then the URL-style
1027notation `%20` can be used for the space character in order to avoid having
1028to quote the option. For example, `-opt%20arg` gets expanded to `-opt arg`.
1029In fact, any ASCII character can be encoded as %xx using its hexadecimal
1030encoding.
1031
1032Take note of the [Environment Variables](#environment-variables) documentation
1033below and how these flags interact with those variables.
1034
1035### Environment Variables
1036
1037 VAR=value
1038
1039Assign the given value to the environment variable `VAR` for `Configure`.
1040
1041These work just like normal environment variable assignments, but are supported
1042on all platforms and are confined to the configuration scripts only.
1043These assignments override the corresponding value in the inherited environment,
1044if there is one.
1045
1046The following variables are used as "`make` variables" and can be used as an
1047alternative to giving preprocessor, compiler and linker options directly as
1048configuration. The following variables are supported:
1049
1050 AR The static library archiver.
1051 ARFLAGS Flags for the static library archiver.
1052 AS The assembler compiler.
1053 ASFLAGS Flags for the assembler compiler.
1054 CC The C compiler.
1055 CFLAGS Flags for the C compiler.
1056 CXX The C++ compiler.
1057 CXXFLAGS Flags for the C++ compiler.
1058 CPP The C/C++ preprocessor.
1059 CPPFLAGS Flags for the C/C++ preprocessor.
1060 CPPDEFINES List of CPP macro definitions, separated
1061 by a platform specific character (':' or
1062 space for Unix, ';' for Windows, ',' for
1063 VMS). This can be used instead of using
1064 -D (or what corresponds to that on your
1065 compiler) in CPPFLAGS.
1066 CPPINCLUDES List of CPP inclusion directories, separated
1067 the same way as for CPPDEFINES. This can
1068 be used instead of -I (or what corresponds
1069 to that on your compiler) in CPPFLAGS.
1070 HASHBANGPERL Perl invocation to be inserted after '#!'
1071 in public perl scripts (only relevant on
1072 Unix).
1073 LD The program linker (not used on Unix, $(CC)
1074 is used there).
1075 LDFLAGS Flags for the shared library, DSO and
1076 program linker.
1077 LDLIBS Extra libraries to use when linking.
1078 Takes the form of a space separated list
1079 of library specifications on Unix and
1080 Windows, and as a comma separated list of
1081 libraries on VMS.
1082 RANLIB The library archive indexer.
1083 RC The Windows resource compiler.
1084 RCFLAGS Flags for the Windows resource compiler.
1085 RM The command to remove files and directories.
1086
1087These cannot be mixed with compiling/linking flags given on the command line.
1088In other words, something like this isn't permitted.
1089
1090 $ ./Configure -DFOO CPPFLAGS=-DBAR -DCOOKIE
1091
1092Backward compatibility note:
1093
1094To be compatible with older configuration scripts, the environment variables
1095are ignored if compiling/linking flags are given on the command line, except
1096for the following:
1097
1098 AR, CC, CXX, CROSS_COMPILE, HASHBANGPERL, PERL, RANLIB, RC, and WINDRES
1099
1100For example, the following command will not see `-DBAR`:
1101
1102 $ CPPFLAGS=-DBAR ./Configure -DCOOKIE
1103
1104However, the following will see both set variables:
1105
1106 $ CC=gcc CROSS_COMPILE=x86_64-w64-mingw32- ./Configure -DCOOKIE
1107
1108If `CC` is set, it is advisable to also set `CXX` to ensure both the C and C++
1109compiler are in the same "family". This becomes relevant with
1110`enable-external-tests` and `enable-buildtest-c++`.
1111
1112### Reconfigure
1113
1114 reconf
1115 reconfigure
1116
1117Reconfigure from earlier data.
1118
1119This fetches the previous command line options and environment from data
1120saved in `configdata.pm` and runs the configuration process again, using
1121these options and environment. Note: NO other option is permitted together
1122with `reconf`. Note: The original configuration saves away values for ALL
1123environment variables that were used, and if they weren't defined, they are
1124still saved away with information that they weren't originally defined.
1125This information takes precedence over environment variables that are
1126defined when reconfiguring.
1127
1128Displaying configuration data
1129-----------------------------
1130
1131The configuration script itself will say very little, and finishes by
1132creating `configdata.pm`. This perl module can be loaded by other scripts
1133to find all the configuration data, and it can also be used as a script to
1134display all sorts of configuration data in a human readable form.
1135
1136For more information, please do:
1137
1138 $ ./configdata.pm --help # Unix
1139
1140or
1141
1142 $ perl configdata.pm --help # Windows and VMS
1143
1144Installation Steps in Detail
1145============================
1146
1147Configure OpenSSL
1148-----------------
1149
1150### Automatic Configuration
1151
1152In previous version, the `config` script determined the platform type and
1153compiler and then called `Configure`. Starting with this release, they are
1154the same.
1155
1156#### Unix / Linux / macOS
1157
1158 $ ./Configure [[ options ]]
1159
1160#### OpenVMS
1161
1162 $ perl Configure [[ options ]]
1163
1164#### Windows
1165
1166 $ perl Configure [[ options ]]
1167
1168### Manual Configuration
1169
1170OpenSSL knows about a range of different operating system, hardware and
1171compiler combinations. To see the ones it knows about, run
1172
1173 $ ./Configure LIST # Unix
1174
1175or
1176
1177 $ perl Configure LIST # All other platforms
1178
1179For the remainder of this text, the Unix form will be used in all examples.
1180Please use the appropriate form for your platform.
1181
1182Pick a suitable name from the list that matches your system. For most
1183operating systems there is a choice between using cc or gcc.
1184When you have identified your system (and if necessary compiler) use this
1185name as the argument to `Configure`. For example, a `linux-elf` user would
1186run:
1187
1188 $ ./Configure linux-elf [[ options ]]
1189
1190### Creating your own Configuration
1191
1192If your system isn't listed, you will have to create a configuration
1193file named `Configurations/{{ something }}.conf` and add the correct
1194configuration for your system. See the available configs as examples
1195and read [Configurations/README.md](Configurations/README.md) and
1196[Configurations/README-design.md](Configurations/README-design.md)
1197for more information.
1198
1199The generic configurations `cc` or `gcc` should usually work on 32 bit
1200Unix-like systems.
1201
1202`Configure` creates a build file (`Makefile` on Unix, `makefile` on Windows
1203and `descrip.mms` on OpenVMS) from a suitable template in `Configurations/`,
1204and defines various macros in `include/openssl/configuration.h` (generated
1205from `include/openssl/configuration.h.in`.
1206
1207### Out of Tree Builds
1208
1209OpenSSL can be configured to build in a build directory separate from the
1210source code directory. It's done by placing yourself in some other
1211directory and invoking the configuration commands from there.
1212
1213#### Unix example
1214
1215 $ mkdir /var/tmp/openssl-build
1216 $ cd /var/tmp/openssl-build
1217 $ /PATH/TO/OPENSSL/SOURCE/Configure [[ options ]]
1218
1219#### OpenVMS example
1220
1221 $ set default sys$login:
1222 $ create/dir [.tmp.openssl-build]
1223 $ set default [.tmp.openssl-build]
1224 $ perl D:[PATH.TO.OPENSSL.SOURCE]Configure [[ options ]]
1225
1226#### Windows example
1227
1228 $ C:
1229 $ mkdir \temp-openssl
1230 $ cd \temp-openssl
1231 $ perl d:\PATH\TO\OPENSSL\SOURCE\Configure [[ options ]]
1232
1233Paths can be relative just as well as absolute. `Configure` will do its best
1234to translate them to relative paths whenever possible.
1235
1236Build OpenSSL
1237-------------
1238
1239Build OpenSSL by running:
1240
1241 $ make # Unix
1242 $ mms ! (or mmk) OpenVMS
1243 $ nmake # Windows
1244
1245This will build the OpenSSL libraries (`libcrypto.a` and `libssl.a` on
1246Unix, corresponding on other platforms) and the OpenSSL binary
1247(`openssl`). The libraries will be built in the top-level directory,
1248and the binary will be in the `apps/` subdirectory.
1249
1250If the build fails, take a look at the [Build Failures](#build-failures)
1251subsection of the [Troubleshooting](#troubleshooting) section.
1252
1253Test OpenSSL
1254------------
1255
1256After a successful build, and before installing, the libraries should
1257be tested. Run:
1258
1259 $ make test # Unix
1260 $ mms test ! OpenVMS
1261 $ nmake test # Windows
1262
1263**Warning:** you MUST run the tests from an unprivileged account (or disable
1264your privileges temporarily if your platform allows it).
1265
1266See [test/README.md](test/README.md) for further details how run tests.
1267
1268See [test/README-dev.md](test/README-dev.md) for guidelines on adding tests.
1269
1270Install OpenSSL
1271---------------
1272
1273If everything tests ok, install OpenSSL with
1274
1275 $ make install # Unix
1276 $ mms install ! OpenVMS
1277 $ nmake install # Windows
1278
1279Note that in order to perform the install step above you need to have
1280appropriate permissions to write to the installation directory.
1281
1282The above commands will install all the software components in this
1283directory tree under `<PREFIX>` (the directory given with `--prefix` or
1284its default):
1285
1286### Unix / Linux / macOS
1287
1288 bin/ Contains the openssl binary and a few other
1289 utility scripts.
1290 include/openssl
1291 Contains the header files needed if you want
1292 to build your own programs that use libcrypto
1293 or libssl.
1294 lib Contains the OpenSSL library files.
1295 lib/engines Contains the OpenSSL dynamically loadable engines.
1296
1297 share/man/man1 Contains the OpenSSL command line man-pages.
1298 share/man/man3 Contains the OpenSSL library calls man-pages.
1299 share/man/man5 Contains the OpenSSL configuration format man-pages.
1300 share/man/man7 Contains the OpenSSL other misc man-pages.
1301
1302 share/doc/openssl/html/man1
1303 share/doc/openssl/html/man3
1304 share/doc/openssl/html/man5
1305 share/doc/openssl/html/man7
1306 Contains the HTML rendition of the man-pages.
1307
1308### OpenVMS
1309
1310'arch' is replaced with the architecture name, `ALPHA` or `IA64`,
1311'sover' is replaced with the shared library version (`0101` for 1.1), and
1312'pz' is replaced with the pointer size OpenSSL was built with:
1313
1314 [.EXE.'arch'] Contains the openssl binary.
1315 [.EXE] Contains a few utility scripts.
1316 [.include.openssl]
1317 Contains the header files needed if you want
1318 to build your own programs that use libcrypto
1319 or libssl.
1320 [.LIB.'arch'] Contains the OpenSSL library files.
1321 [.ENGINES'sover''pz'.'arch']
1322 Contains the OpenSSL dynamically loadable engines.
1323 [.SYS$STARTUP] Contains startup, login and shutdown scripts.
1324 These define appropriate logical names and
1325 command symbols.
1326 [.SYSTEST] Contains the installation verification procedure.
1327 [.HTML] Contains the HTML rendition of the manual pages.
1328
1329### Additional Directories
1330
1331Additionally, install will add the following directories under
1332OPENSSLDIR (the directory given with `--openssldir` or its default)
1333for you convenience:
1334
1335 certs Initially empty, this is the default location
1336 for certificate files.
1337 private Initially empty, this is the default location
1338 for private key files.
1339 misc Various scripts.
1340
1341The installation directory should be appropriately protected to ensure
1342unprivileged users cannot make changes to OpenSSL binaries or files, or
1343install engines. If you already have a pre-installed version of OpenSSL as
1344part of your Operating System it is recommended that you do not overwrite
1345the system version and instead install to somewhere else.
1346
1347Package builders who want to configure the library for standard locations,
1348but have the package installed somewhere else so that it can easily be
1349packaged, can use
1350
1351 $ make DESTDIR=/tmp/package-root install # Unix
1352 $ mms/macro="DESTDIR=TMP:[PACKAGE-ROOT]" install ! OpenVMS
1353
1354The specified destination directory will be prepended to all installation
1355target paths.
1356
1357Compatibility issues with previous OpenSSL versions
1358---------------------------------------------------
1359
1360### COMPILING existing applications
1361
1362Starting with version 1.1.0, OpenSSL hides a number of structures that were
1363previously open. This includes all internal libssl structures and a number
1364of EVP types. Accessor functions have been added to allow controlled access
1365to the structures' data.
1366
1367This means that some software needs to be rewritten to adapt to the new ways
1368of doing things. This often amounts to allocating an instance of a structure
1369explicitly where you could previously allocate them on the stack as automatic
1370variables, and using the provided accessor functions where you would previously
1371access a structure's field directly.
1372
1373Some APIs have changed as well. However, older APIs have been preserved when
1374possible.
1375
1376Post-installation Notes
1377-----------------------
1378
1379With the default OpenSSL installation comes a FIPS provider module, which
1380needs some post-installation attention, without which it will not be usable.
1381This involves using the following command:
1382
1383 $ openssl fipsinstall
1384
1385See the openssl-fipsinstall(1) manual for details and examples.
1386
1387Advanced Build Options
1388======================
1389
1390Environment Variables
1391---------------------
1392
1393A number of environment variables can be used to provide additional control
1394over the build process. Typically these should be defined prior to running
1395`Configure`. Not all environment variables are relevant to all platforms.
1396
1397 AR
1398 The name of the ar executable to use.
1399
1400 BUILDFILE
1401 Use a different build file name than the platform default
1402 ("Makefile" on Unix-like platforms, "makefile" on native Windows,
1403 "descrip.mms" on OpenVMS). This requires that there is a
1404 corresponding build file template.
1405 See [Configurations/README.md](Configurations/README.md)
1406 for further information.
1407
1408 CC
1409 The compiler to use. Configure will attempt to pick a default
1410 compiler for your platform but this choice can be overridden
1411 using this variable. Set it to the compiler executable you wish
1412 to use, e.g. gcc or clang.
1413
1414 CROSS_COMPILE
1415 This environment variable has the same meaning as for the
1416 "--cross-compile-prefix" Configure flag described above. If both
1417 are set then the Configure flag takes precedence.
1418
1419 HASHBANGPERL
1420 The command string for the Perl executable to insert in the
1421 #! line of perl scripts that will be publicly installed.
1422 Default: /usr/bin/env perl
1423 Note: the value of this variable is added to the same scripts
1424 on all platforms, but it's only relevant on Unix-like platforms.
1425
1426 KERNEL_BITS
1427 This can be the value `32` or `64` to specify the architecture
1428 when it is not "obvious" to the configuration. It should generally
1429 not be necessary to specify this environment variable.
1430
1431 NM
1432 The name of the nm executable to use.
1433
1434 OPENSSL_LOCAL_CONFIG_DIR
1435 OpenSSL comes with a database of information about how it
1436 should be built on different platforms as well as build file
1437 templates for those platforms. The database is comprised of
1438 ".conf" files in the Configurations directory. The build
1439 file templates reside there as well as ".tmpl" files. See the
1440 file [Configurations/README.md](Configurations/README.md)
1441 for further information about the format of ".conf" files
1442 as well as information on the ".tmpl" files.
1443 In addition to the standard ".conf" and ".tmpl" files, it is
1444 possible to create your own ".conf" and ".tmpl" files and
1445 store them locally, outside the OpenSSL source tree.
1446 This environment variable can be set to the directory where
1447 these files are held and will be considered by Configure
1448 before it looks in the standard directories.
1449
1450 PERL
1451 The name of the Perl executable to use when building OpenSSL.
1452 Only needed if builing should use a different Perl executable
1453 than what is used to run the Configure script.
1454
1455 RANLIB
1456 The name of the ranlib executable to use.
1457
1458 RC
1459 The name of the rc executable to use. The default will be as
1460 defined for the target platform in the ".conf" file. If not
1461 defined then "windres" will be used. The WINDRES environment
1462 variable is synonymous to this. If both are defined then RC
1463 takes precedence.
1464
1465 WINDRES
1466 See RC.
1467
1468Makefile Targets
1469----------------
1470
1471The `Configure` script generates a Makefile in a format relevant to the specific
1472platform. The Makefiles provide a number of targets that can be used. Not all
1473targets may be available on all platforms. Only the most common targets are
1474described here. Examine the Makefiles themselves for the full list.
1475
1476 all
1477 The target to build all the software components and
1478 documentation.
1479
1480 build_sw
1481 Build all the software components.
1482 THIS IS THE DEFAULT TARGET.
1483
1484 build_docs
1485 Build all documentation components.
1486
1487 clean
1488 Remove all build artefacts and return the directory to a "clean"
1489 state.
1490
1491 depend
1492 Rebuild the dependencies in the Makefiles. This is a legacy
1493 option that no longer needs to be used since OpenSSL 1.1.0.
1494
1495 install
1496 Install all OpenSSL components.
1497
1498 install_sw
1499 Only install the OpenSSL software components.
1500
1501 install_docs
1502 Only install the OpenSSL documentation components.
1503
1504 install_man_docs
1505 Only install the OpenSSL man pages (Unix only).
1506
1507 install_html_docs
1508 Only install the OpenSSL HTML documentation.
1509
1510 install_fips
1511 Install the FIPS provider module configuration file.
1512
1513 list-tests
1514 Prints a list of all the self test names.
1515
1516 test
1517 Build and run the OpenSSL self tests.
1518
1519 uninstall
1520 Uninstall all OpenSSL components.
1521
1522 reconfigure
1523 reconf
1524 Re-run the configuration process, as exactly as the last time
1525 as possible.
1526
1527 update
1528 This is a developer option. If you are developing a patch for
1529 OpenSSL you may need to use this if you want to update
1530 automatically generated files; add new error codes or add new
1531 (or change the visibility of) public API functions. (Unix only).
1532
1533Running Selected Tests
1534----------------------
1535
1536You can specify a set of tests to be performed
1537using the `make` variable `TESTS`.
1538
1539See the section [Running Selected Tests of
1540test/README.md](test/README.md#running-selected-tests).
1541
1542Troubleshooting
1543===============
1544
1545Configuration Problems
1546----------------------
1547
1548### Selecting the correct target
1549
1550The `./Configure` script tries hard to guess your operating system, but in some
1551cases it does not succeed. You will see a message like the following:
1552
1553 $ ./Configure
1554 Operating system: x86-whatever-minix
1555 This system (minix) is not supported. See file INSTALL.md for details.
1556
1557Even if the automatic target selection by the `./Configure` script fails,
1558chances are that you still might find a suitable target in the `Configurations`
1559directory, which you can supply to the `./Configure` command,
1560possibly after some adjustment.
1561
1562The `Configurations/` directory contains a lot of examples of such targets.
1563The main configuration file is [10-main.conf], which contains all targets that
1564are officially supported by the OpenSSL team. Other configuration files contain
1565targets contributed by other OpenSSL users. The list of targets can be found in
1566a Perl list `my %targets = ( ... )`.
1567
1568 my %targets = (
1569 ...
1570 "target-name" => {
1571 inherit_from => [ "base-target" ],
1572 CC => "...",
1573 cflags => add("..."),
1574 asm_arch => '...',
1575 perlasm_scheme => "...",
1576 },
1577 ...
1578 )
1579
1580If you call `./Configure` without arguments, it will give you a list of all
1581known targets. Using `grep`, you can lookup the target definition in the
1582`Configurations/` directory. For example the `android-x86_64` can be found in
1583[Configurations/15-android.conf](Configurations/15-android.conf).
1584
1585The directory contains two README files, which explain the general syntax and
1586design of the configuration files.
1587
1588 - [Configurations/README.md](Configurations/README.md)
1589 - [Configurations/README-design.md](Configurations/README-design.md)
1590
1591If you need further help, try to search the [openssl-users] mailing list
1592or the [GitHub Issues] for existing solutions. If you don't find anything,
1593you can [raise an issue] to ask a question yourself.
1594
1595More about our support resources can be found in the [SUPPORT] file.
1596
1597### Configuration Errors
1598
1599If the `./Configure` or `./Configure` command fails with an error message,
1600read the error message carefully and try to figure out whether you made
1601a mistake (e.g., by providing a wrong option), or whether the script is
1602working incorrectly. If you think you encountered a bug, please
1603[raise an issue] on GitHub to file a bug report.
1604
1605Along with a short description of the bug, please provide the complete
1606configure command line and the relevant output including the error message.
1607
1608Note: To make the output readable, pleace add a 'code fence' (three backquotes
1609` ``` ` on a separate line) before and after your output:
1610
1611 ```
1612 ./Configure [your arguments...]
1613
1614 [output...]
1615
1616 ```
1617
1618Build Failures
1619--------------
1620
1621If the build fails, look carefully at the output. Try to locate and understand
1622the error message. It might be that the compiler is already telling you
1623exactly what you need to do to fix your problem.
1624
1625There may be reasons for the failure that aren't problems in OpenSSL itself,
1626for example if the compiler reports missing standard or third party headers.
1627
1628If the build succeeded previously, but fails after a source or configuration
1629change, it might be helpful to clean the build tree before attempting another
1630build. Use this command:
1631
1632 $ make clean # Unix
1633 $ mms clean ! (or mmk) OpenVMS
1634 $ nmake clean # Windows
1635
1636Assembler error messages can sometimes be sidestepped by using the `no-asm`
1637configuration option. See also [notes](#notes-on-assembler-modules-compilation).
1638
1639Compiling parts of OpenSSL with gcc and others with the system compiler will
1640result in unresolved symbols on some systems.
1641
1642If you are still having problems, try to search the [openssl-users] mailing
1643list or the [GitHub Issues] for existing solutions. If you think you
1644encountered an OpenSSL bug, please [raise an issue] to file a bug report.
1645Please take the time to review the existing issues first; maybe the bug was
1646already reported or has already been fixed.
1647
1648Test Failures
1649-------------
1650
1651If some tests fail, look at the output. There may be reasons for the failure
1652that isn't a problem in OpenSSL itself (like an OS malfunction or a Perl issue).
1653
1654You may want increased verbosity, that can be accomplished as described in
1655section [Test Failures of test/README.md](test/README.md#test-failures).
1656
1657You may also want to selectively specify which test(s) to perform. This can be
1658done using the `make` variable `TESTS` as described in section [Running
1659Selected Tests of test/README.md](test/README.md#running-selected-tests).
1660
1661If you find a problem with OpenSSL itself, try removing any
1662compiler optimization flags from the `CFLAGS` line in the Makefile and
1663run `make clean; make` or corresponding.
1664
1665To report a bug please open an issue on GitHub, at
1666<https://github.com/openssl/openssl/issues>.
1667
1668Notes
1669=====
1670
1671Notes on multi-threading
1672------------------------
1673
1674For some systems, the OpenSSL `Configure` script knows what compiler options
1675are needed to generate a library that is suitable for multi-threaded
1676applications. On these systems, support for multi-threading is enabled
1677by default; use the `no-threads` option to disable (this should never be
1678necessary).
1679
1680On other systems, to enable support for multi-threading, you will have
1681to specify at least two options: `threads`, and a system-dependent option.
1682(The latter is `-D_REENTRANT` on various systems.) The default in this
1683case, obviously, is not to include support for multi-threading (but
1684you can still use `no-threads` to suppress an annoying warning message
1685from the `Configure` script.)
1686
1687OpenSSL provides built-in support for two threading models: pthreads (found on
1688most UNIX/Linux systems), and Windows threads. No other threading models are
1689supported. If your platform does not provide pthreads or Windows threads then
1690you should use `Configure` with the `no-threads` option.
1691
1692For pthreads, all locks are non-recursive. In addition, in a debug build,
1693the mutex attribute `PTHREAD_MUTEX_ERRORCHECK` is used. If this is not
1694available on your platform, you might have to add
1695`-DOPENSSL_NO_MUTEX_ERRORCHECK` to your `Configure` invocation.
1696(On Linux `PTHREAD_MUTEX_ERRORCHECK` is an enum value, so a built-in
1697ifdef test cannot be used.)
1698
1699Notes on shared libraries
1700-------------------------
1701
1702For most systems the OpenSSL `Configure` script knows what is needed to
1703build shared libraries for libcrypto and libssl. On these systems
1704the shared libraries will be created by default. This can be suppressed and
1705only static libraries created by using the `no-shared` option. On systems
1706where OpenSSL does not know how to build shared libraries the `no-shared`
1707option will be forced and only static libraries will be created.
1708
1709Shared libraries are named a little differently on different platforms.
1710One way or another, they all have the major OpenSSL version number as
1711part of the file name, i.e. for OpenSSL 1.1.x, `1.1` is somehow part of
1712the name.
1713
1714On most POSIX platforms, shared libraries are named `libcrypto.so.1.1`
1715and `libssl.so.1.1`.
1716
1717on Cygwin, shared libraries are named `cygcrypto-1.1.dll` and `cygssl-1.1.dll`
1718with import libraries `libcrypto.dll.a` and `libssl.dll.a`.
1719
1720On Windows build with MSVC or using MingW, shared libraries are named
1721`libcrypto-1_1.dll` and `libssl-1_1.dll` for 32-bit Windows,
1722`libcrypto-1_1-x64.dll` and `libssl-1_1-x64.dll` for 64-bit x86_64 Windows,
1723and `libcrypto-1_1-ia64.dll` and `libssl-1_1-ia64.dll` for IA64 Windows.
1724With MSVC, the import libraries are named `libcrypto.lib` and `libssl.lib`,
1725while with MingW, they are named `libcrypto.dll.a` and `libssl.dll.a`.
1726
1727On VMS, shareable images (VMS speak for shared libraries) are named
1728`ossl$libcrypto0101_shr.exe` and `ossl$libssl0101_shr.exe`. However, when
1729OpenSSL is specifically built for 32-bit pointers, the shareable images
1730are named `ossl$libcrypto0101_shr32.exe` and `ossl$libssl0101_shr32.exe`
1731instead, and when built for 64-bit pointers, they are named
1732`ossl$libcrypto0101_shr64.exe` and `ossl$libssl0101_shr64.exe`.
1733
1734Notes on random number generation
1735---------------------------------
1736
1737Availability of cryptographically secure random numbers is required for
1738secret key generation. OpenSSL provides several options to seed the
1739internal CSPRNG. If not properly seeded, the internal CSPRNG will refuse
1740to deliver random bytes and a "PRNG not seeded error" will occur.
1741
1742The seeding method can be configured using the `--with-rand-seed` option,
1743which can be used to specify a comma separated list of seed methods.
1744However, in most cases OpenSSL will choose a suitable default method,
1745so it is not necessary to explicitly provide this option. Note also
1746that not all methods are available on all platforms. The FIPS provider will
1747silently ignore seed sources that were not validated.
1748
1749I) On operating systems which provide a suitable randomness source (in
1750form of a system call or system device), OpenSSL will use the optimal
1751available method to seed the CSPRNG from the operating system's
1752randomness sources. This corresponds to the option `--with-rand-seed=os`.
1753
1754II) On systems without such a suitable randomness source, automatic seeding
1755and reseeding is disabled (`--with-rand-seed=none`) and it may be necessary
1756to install additional support software to obtain a random seed and reseed
1757the CSPRNG manually. Please check out the manual pages for `RAND_add()`,
1758`RAND_bytes()`, `RAND_egd()`, and the FAQ for more information.
1759
1760Notes on assembler modules compilation
1761--------------------------------------
1762
1763Compilation of some code paths in assembler modules might depend on whether the
1764current assembler version supports certain ISA extensions or not. Code paths
1765that use the AES-NI, PCLMULQDQ, SSSE3, and SHA extensions are always assembled.
1766Apart from that, the minimum requirements for the assembler versions are shown
1767in the table below:
1768
1769| ISA extension | GNU as | nasm | llvm |
1770|---------------|--------|--------|---------|
1771| AVX | 2.19 | 2.09 | 3.0 |
1772| AVX2 | 2.22 | 2.10 | 3.1 |
1773| ADCX/ADOX | 2.23 | 2.10 | 3.3 |
1774| AVX512 | 2.25 | 2.11.8 | 3.6 (*) |
1775| AVX512IFMA | 2.26 | 2.11.8 | 6.0 (*) |
1776| VAES | 2.30 | 2.13.3 | 6.0 (*) |
1777
1778---
1779
1780(*) Even though AVX512 support was implemented in llvm 3.6, prior to version 7.0
1781an explicit -march flag was apparently required to compile assembly modules. But
1782then the compiler generates processor-specific code, which in turn contradicts
1783the idea of performing dispatch at run-time, which is facilitated by the special
1784variable `OPENSSL_ia32cap`. For versions older than 7.0, it is possible to work
1785around the problem by forcing the build procedure to use the following script:
1786
1787 #!/bin/sh
1788 exec clang -no-integrated-as "$@"
1789
1790instead of the real clang. In which case it doesn't matter what clang version
1791is used, as it is the version of the GNU assembler that will be checked.
1792
1793---
1794
1795<!-- Links -->
1796
1797[openssl-users]:
1798 <https://mta.openssl.org/mailman/listinfo/openssl-users>
1799
1800[SUPPORT]:
1801 ./SUPPORT.md
1802
1803[GitHub Issues]:
1804 <https://github.com/openssl/openssl/issues>
1805
1806[raise an issue]:
1807 <https://github.com/openssl/openssl/issues/new/choose>
1808
1809[10-main.conf]:
1810 Configurations/10-main.conf
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette