Compilation and Installation - Revision history

Levitte: gcc knowns -rpath=DIR, clang does not.

2025-01-15T12:53:41Z

gcc knowns -rpath=DIR, clang does not.

Klaustriendl: Correct "its" -> "it's"

2021-04-16T13:58:55Z

Correct "its" -> "it's"

Jwalton: /* Using RPATHs */

2021-03-29T19:19:05Z

Using RPATHs

Jwalton: Add info on RUNPATHs

2021-03-29T19:14:04Z

Add info on RUNPATHs

Jwalton: Add info on NO_FORK option.

2020-03-10T05:52:09Z

Add info on NO_FORK option.

Lmcnerney: /* Windows */ modifieded verbiage for clarity.

2020-01-16T19:43:14Z

Windows: modifieded verbiage for clarity.

Lmcnerney: /* Windows */ Updated broken link to archived version of 3noch's guide to building OpenSSL on Windows.

2020-01-16T19:41:20Z

Windows: Updated broken link to archived version of 3noch's guide to building OpenSSL on Windows.

Matt: /* OpenSSL 1.0.2 */ Add instructions for perl and NASM

2019-10-04T22:20:40Z

OpenSSL 1.0.2: Add instructions for perl and NASM

Matt: /* OpenSSL 1.1.0 */ Add instructions for perl and NASM, and make some tweaks.

2019-10-04T22:19:47Z

OpenSSL 1.1.0: Add instructions for perl and NASM, and make some tweaks.

Davidzwa: /* OpenSSL 1.1.0 */

2019-10-04T14:39:01Z

OpenSSL 1.1.0

@@ Line 290: / Line 290: @@
 <tt>RPATH</tt>'s are supported by default on the BSD platforms, but not others. If you are working on Linux and compatibles, then you have to manually add an RPATH. One of the easiest ways to add a <tt>RPATH</tt> is to configure with it as shown below.
-<pre>./config -Wl,-rpath=/usr/local/ssl/lib</pre>
+<pre>./config -Wl,-rpath,/usr/local/ssl/lib</pre>
 For modern Linux you should also use <tt>-Wl,--enable-new-dtags</tt>. The linker option sets a <tt>RUNPATH</tt> as opposed to a <tt>RPATH</tt>. A <tt>RUNPATH</tt> allows library path overrides at runtime, while a <tt>RPATH</tt> does not.
-<pre>./config -Wl,-rpath=/usr/local/ssl/lib -Wl,--enable-new-dtags</pre>
+<pre>./config -Wl,-rpath,/usr/local/ssl/lib -Wl,--enable-new-dtags</pre>
 '''''Note well''''': you should use a <tt>RPATH</tt> or <tt>RUNPATH</tt> when building both OpenSSL and your program. If you don't add a <tt>RPATH</tt> or <tt>RUNPATH</tt> to both, then your program could runtime-link to the wrong version of OpenSSL. Linking against random versions of a security library is ''not'' a good idea.
-You can also add an <tt>RPATH</tt> or <tt>RUNPATH</tt> by hard coding the <tt>RPATH</tt> into a configure line. For example, on Debian x86_64 open the file <tt>Configure</tt> in an editor, copy <tt>linux-x86_64</tt>, name it <tt>linux-x86_64-rpath</tt>, and make the following change to add the <tt>-rpath</tt> option. Notice the addition of <tt>-Wl,-rpath=...</tt> in two places.
+You can also add an <tt>RPATH</tt> or <tt>RUNPATH</tt> by hard coding the <tt>RPATH</tt> into a configure line. For example, on Debian x86_64 open the file <tt>Configure</tt> in an editor, copy <tt>linux-x86_64</tt>, name it <tt>linux-x86_64-rpath</tt>, and make the following change to add the <tt>-rpath</tt> option. Notice the addition of <tt>-Wl,-rpath,...</tt> in two places.
-<pre>"linux-x86_64-rpath", "gcc:-m64 -DL_ENDIAN -O3 -Wall -Wl,-rpath=/usr/local/ssl/lib::
+<pre>"linux-x86_64-rpath", "gcc:-m64 -DL_ENDIAN -O3 -Wall -Wl,-rpath,/usr/local/ssl/lib::
-   -D_REENTRANT::-Wl,-rpath=/usr/local/ssl/lib -ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:
+   -D_REENTRANT::-Wl,-rpath,/usr/local/ssl/lib -ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:
    ${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",</pre>

@@ Line 15: / Line 15: @@
 The OpenSSL source code can be downloaded from [http://www.openssl.org/source/ OpenSSL Source Tarballs] or any suitable [http://www.openssl.org/source/mirror.html ftp mirror]. There are various versions including stable as well as unstable versions.
-The source code is managed via Git. Its referred to as Master. The repository is
+The source code is managed via Git. It's referred to as Master. The repository is
 : git://git.openssl.org/openssl.git
@@ Line 53: / Line 53: @@
 === Configure & Config ===
-You use <tt>Configure</tt> and <tt>config</tt> to tune the compile and installation process through options and switches. The difference between is <tt>Configure</tt> properly handles the host-arch-compiler triplet, and <tt>config</tt> does not. <tt>config</tt> attempts to guess the triplet, so its a lot like autotool's <tt>config.guess</tt>.
+You use <tt>Configure</tt> and <tt>config</tt> to tune the compile and installation process through options and switches. The difference between is <tt>Configure</tt> properly handles the host-arch-compiler triplet, and <tt>config</tt> does not. <tt>config</tt> attempts to guess the triplet, so it's a lot like autotool's <tt>config.guess</tt>.
 You can usually use <tt>config</tt> and it will do the right thing (from Ubuntu 13.04, x64):
@@ Line 67: / Line 67: @@
      ...</pre>
-Mac OS X can have issues (its often a neglected platform), and you will have to use <tt>Configure</tt>:
+Mac OS X can have issues (it's often a neglected platform), and you will have to use <tt>Configure</tt>:
 <pre> ./Configure darwin64-x86_64-cc
@@ Line 115: / Line 115: @@
 === Dependencies ===
-If you are prompted to run <tt>make depend</tt>, then you must do so. For OpenSSL 1.0.2 and below, its required to update the standard distribution once configuration options change.
+If you are prompted to run <tt>make depend</tt>, then you must do so. For OpenSSL 1.0.2 and below, it's required to update the standard distribution once configuration options change.
 <pre>Since you've disabled or enabled at least one algorithm, you need to do
@@ Line 179: / Line 179: @@
 | no-npn/no-nextprotoneg || Disables Next Protocol Negotiation (NPN). Use <tt>no-nextprotoneg</tt> for 1.1.0 and above; and <tt>no-npn</tt> otherwise
 |-
-| no-psk || Disables Preshared Key (PSK). PSK provides mutual authentication independent of trusted authorities, but its rarely offered or used
+| no-psk || Disables Preshared Key (PSK). PSK provides mutual authentication independent of trusted authorities, but it's rarely offered or used
 |-
-| no-srp || Disables Secure Remote Password (SRP). SRP provides mutual authentication independent of trusted authorities, but its rarely offered or used
+| no-srp || Disables Secure Remote Password (SRP). SRP provides mutual authentication independent of trusted authorities, but it's rarely offered or used
 |-
 | no-ec2m || Used when configuring FIPS Capable Library with a FIPS Object Module that only includes prime curves. That is, use this switch if you use <tt>openssl-fips-ecp-2.0.5</tt>.
@@ Line 236: / Line 236: @@
 === Debug Configuration ===
-From the list above, its possible to quickly configure a "debug" build with <tt>./config -d</tt>. However, you can often get into a more amicable state ''without'' the [http://en.wikipedia.org/wiki/Electric_Fence Electric Fence] dependency by issuing:
+From the list above, it's possible to quickly configure a "debug" build with <tt>./config -d</tt>. However, you can often get into a more amicable state ''without'' the [http://en.wikipedia.org/wiki/Electric_Fence Electric Fence] dependency by issuing:
 <pre>$ ./config no-asm -g3 -O0 -fno-omit-frame-pointer -fno-inline-functions
@@ Line 258: / Line 258: @@
 Sometimes you need to work around OpenSSL's selections for building the library. For example, you might want to use <tt>-Os</tt> for a mobile device (rather than <tt>-O3</tt>), or you might want to use the <tt>clang</tt> compiler (rather than <tt>gcc</tt>).
-In case like these, its often easier to modify <tt>Configure</tt> and <tt>Makefile.org</tt> rather than trying to add targets to the configure scripts. Below is a patch that modifies <tt>Configure</tt> and <tt>Makefile.org</tt> for use under the iOS 7.0 SDK (which lacks <tt>gcc</tt> in <tt>/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/</tt>):
+In case like these, its' often easier to modify <tt>Configure</tt> and <tt>Makefile.org</tt> rather than trying to add targets to the configure scripts. Below is a patch that modifies <tt>Configure</tt> and <tt>Makefile.org</tt> for use under the iOS 7.0 SDK (which lacks <tt>gcc</tt> in <tt>/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/</tt>):
 * Modifies <tt>Configure</tt> to use <tt>clang</tt>

@@ Line 292: / Line 292: @@
 <pre>./config -Wl,-rpath=/usr/local/ssl/lib</pre>
-For modern Linux you should also use <tt>-Wl,--enable-new-dtags</tt>. The linker option sets a RUNPATH as opposed to a RPATH. A RUNPATH allows runtime path overrides, while a RPATH does not.
+For modern Linux you should also use <tt>-Wl,--enable-new-dtags</tt>. The linker option sets a <tt>RUNPATH</tt> as opposed to a <tt>RPATH</tt>. A <tt>RUNPATH</tt> allows library path overrides at runtime, while a <tt>RPATH</tt> does not.
 <pre>./config -Wl,-rpath=/usr/local/ssl/lib -Wl,--enable-new-dtags</pre>
-'''''Note well''''': you should use a RPATH or RUNPATH when building both OpenSSL and your program. If you don't add a RPATH or RUNPATH to both, then your program could runtime-link to the wrong version of OpenSSL. Linking against random versions of a security library is ''not'' a good idea.
+'''''Note well''''': you should use a <tt>RPATH</tt> or <tt>RUNPATH</tt> when building both OpenSSL and your program. If you don't add a <tt>RPATH</tt> or <tt>RUNPATH</tt> to both, then your program could runtime-link to the wrong version of OpenSSL. Linking against random versions of a security library is ''not'' a good idea.
 You can also add an <tt>RPATH</tt> or <tt>RUNPATH</tt> by hard coding the <tt>RPATH</tt> into a configure line. For example, on Debian x86_64 open the file <tt>Configure</tt> in an editor, copy <tt>linux-x86_64</tt>, name it <tt>linux-x86_64-rpath</tt>, and make the following change to add the <tt>-rpath</tt> option. Notice the addition of <tt>-Wl,-rpath=...</tt> in two places.

@@ Line 292: / Line 292: @@
 <pre>./config -Wl,-rpath=/usr/local/ssl/lib</pre>
-'''''Note well''''': you should use a RPATH when building both OpenSSL and your program. If you don't add a RPATH to both, then your program could runtime-link to the wrong version of OpenSSL.
+For modern Linux you should also use <tt>-Wl,--enable-new-dtags</tt>. The linker option sets a RUNPATH as opposed to a RPATH. A RUNPATH allows runtime path overrides, while a RPATH does not.
-You can also add an <tt>RPATH</tt> by hard coding the <tt>RPATH</tt> into a configure line. For example, on Debian x86_64 open the file <tt>Configure</tt> in an editor, copy <tt>linux-x86_64</tt>, name it <tt>linux-x86_64-rpath</tt>, and make the following change to add the <tt>-rpath</tt> option. Notice the addition of <tt>-Wl,-rpath=...</tt> in two places.
+<pre>./config -Wl,-rpath=/usr/local/ssl/lib -Wl,--enable-new-dtags</pre>
 <pre>"linux-x86_64-rpath", "gcc:-m64 -DL_ENDIAN -O3 -Wall -Wl,-rpath=/usr/local/ssl/lib::
@@ Line 309: / Line 313: @@
 Finally, after <tt>make</tt>, verify the settings stuck:
-<pre>$ readelf -d ./libssl.so | grep -i rpath
+<pre>$ readelf -d ./libssl.so | grep -i -E 'rpath|runpath'
 x000000000000000f (RPATH)              Library rpath: [/usr/local/ssl/lib]
 $ readelf -d ./libcrypto.so | grep -i rpath

@@ Line 192: / Line 192: @@
 |-
 | -DOPENSSL_USE_IPV6=0 || Disables IPv6. Useful if OpenSSL encounters incorrect or inconsistent platform headers and mistakenly enables IPv6. Must be passed to <tt>Configure</tt> manually.
 |-
 | -L''something'', -l''something'', -K''something'', -Wl,''something'' || Linker options, will become part of LDFLAGS.

@@ Line 394: / Line 394: @@
 === Windows ===
-noch wrote a VERY good guide in 2012 [https://web.archive.org/web/20161123004257/http://developer.covenanteyes.com/building-openssl-for-visual-studio// here] (PLEASE NOTE: the original article is from 2012 and is no longer hosted at the original location; the link provided is from the Internet Archive Wayback Machine).
+noch wrote a VERY good guide in 2012 [https://web.archive.org/web/20161123004257/http://developer.covenanteyes.com/building-openssl-for-visual-studio// here] (PLEASE NOTE: the guide was written in 2012 and is no longer available at the original location; the link now points to an archived version at the Internet Archive Wayback Machine).
 Like he said in his article, make absolutely sure to create separate directories for 32 and 64 bit versions.

@@ Line 441: / Line 441: @@
 For OpenSSL 1.0.2 and earlier the procedure is as follows.
 # launch a Visual Studio tool x64 Cross Tools Command prompt
 # change to the directory where you have copied openssl sources <code>cd c:\myPath\openssl</code>
-# configure for the target OS with the command <code>perl Configure VC-WIN64A</code>. You may also be interested to set more configuration options as documented in the general INSTALL note (for UNIX targets). For instance: <code>perl Configure no-asm VC-WIN64A</code>.
+# configure for the target OS with the command <code>perl Configure VC-WIN64A</code>. You may also be interested to set more configuration options as documented in the general INSTALL note (for UNIX targets). For instance: <code>perl Configure VC-WIN64A</code>.
 # prepare the target environment with the command: <code>ms\do_win64a</code>
 # ensure you start afresh and notably without linkable products from a previous 32bit compile (as 32 and 64 bits compiling still share common directories) with the command: <code>nmake -f ms\ntdll.mak clean</code> for the DLL target and <code>nmake -f ms\nt.mak clean</code> for static libraries.

@@ Line 419: / Line 419: @@
 === OpenSSL 1.1.0 ===
-For OpenSSL 1.1.0+ (confirmed till 1.1.1b) perform these steps:
+For OpenSSL 1.1.0 and above perform these steps:
 # Extract the source files to your folder, here <code>cd c:\myPath\openssl</code>
 # Launch Visual Studio tool x64 Cross Tools Command prompt
 # Goto your defined folder <code>cd c:\myPath\openssl</code>
-# Configure for the target OS with <code>perl Configure VC-WIN64A</code> or other configurations to be found in the INSTALL file (f.e. UNIX targets).
+# Configure for the target OS with <code>perl Configure VC-WIN64A</code> or other configurations to be found in the INSTALL file (e.g. UNIX targets).
-## For instance: <code>perl Configure no-asm VC-WIN64A</code>.
+## For instance: <code>perl Configure VC-WIN64A</code>.
 # (''Optional'') In case you compiled before on 32 or 64-bits, make sure you run <code>nmake clean</code> to prevent trouble across 32 and 64-bits which share output folder.
 # Now build with: <code>nmake</code>
 # Output can be found in the '''root''' of your folder as '''libcrypto-1_1x64.dll''' and '''libssl-1_1-x64.dll''' (with all the build additionals such as .pdb .lik or static .lib). You may check this is true 64bit code using the Visual Studio tool 'dumpbin'. For instance <code>dumpbin  /headers libcrypto-1_1x64.dll | more</code>, and look at the FILE HEADER section.
 # Test the code using the 'test' make target, by running <code>nmake test</code>.
-# Reminder, clean your code to prevent issues the next time you compile for a different target. See step 5.
+# Reminder, clean your code to prevent issues the next time you compile for a different target. See step 7.
 ==== Windows CE ====