Covenant Eyes Developer Portal

Building OpenSSL for Visual Studio

Building OpenSSL for Visual Studio on Windows is mostly straight-forward, but it has some quirks. I’ll document the results of my wrestling here so that future attempts will be less painful.

What you need

You need to install…

Setting up for the build

Unzip the OpenSSL source code into two different folders, one for the 32-bit build and one for the 64-bit build. So, for example, you might end up with C:\openssl-src-32 and C:\openssl-src-64.

Building the 32-bit static libraries

  1. Open the Visual Studio Command Prompt (2010).
  2. cd to your OpenSSL source folder for 32-bit (e.g. cd C:\openssl-src-32).
  3. Run the following: 

Your outputs will be in C:\Build-OpenSSL-VC-32.

Building the 32-bit static libraries with debug symbols

These steps will embed the debug symbols directly into the .lib files. Don’t expect to see any .pdb files.

  1. Open the Visual Studio Command Prompt (2010).
  2. cd to your OpenSSL source folder for 32-bit (e.g. cd C:\openssl-src-32).
  3. Run the following:
  4. In a text editor (like Notepad), open ms\nt.mak and replace all occurrences of /Zi with /Z7. There should be three replacements.
  5. Run the following:

Your outputs will be in C:\Build-OpenSSL-VC-32-dbg. Make sure you rename them to something like libeay32-debug.lib and ssleay32-debug.lib.

Building the 64-bit static libraries

  1. Open the Visual Studio x64 Win64 Command Prompt (2010) (in the Start menu).
  2. cd to your OpenSSL source folder for 64-bit (e.g. cd C:\openssl-src-64).
  3. Run the following:

Your outputs will be in C:\Build-OpenSSL-VC-64.

Note: The outputs of the 64-bit build are still named libeay32.lib and ssleay32.lib. You’ll have to rename them more sensibly yourself.

Building the 64-bit static libraries with debug symbols

These steps will embed the debug symbols directly into the .lib files. Don’t expect to see any .pdb files.

  1. Open the Visual Studio x64 Win64 Command Prompt (2010).
  2. cd to your OpenSSL source folder for 64-bit (e.g. cd C:\openssl-src-64).
  3. Run the following:
  4. In a text editor (like Notepad), open ms\nt.mak and replace all occurrences of /Zi with /Z7 except on the line starting with ASM. There should be two replacements.
  5. Run the following:

Your outputs will be in C:\Build-OpenSSL-VC-64-dbg. Make sure you rename them to something like libeay64-debug.lib and ssleay64-debug.lib.

What not to do

I tried every method under the sun to get a Windows build of OpenSSL that would link against Visual Studio projects. I learned a great deal along the way. Here’s what I learned not to do:

  • Don’t blindly follow the Windows 32-bit/64-bit installation instructions provided in the OpenSSL source folder. Get guidance online.
  • Don’t build OpenSSL in Cygwin. It’s easy. It won’t link against Visual Studio.
  • Don’t build OpenSSL in MSYS or MinGW. It’s hard. It won’t link against Visual Studio.
  • Don’t try to use NASM like the Windows installation instructions mention. It’s not necessary for Visual Studio builds. (It only supports 32-bit anyway.)
  • Strawberry Perl doesn’t always work in these weird configurations. ActivePerl seemed more stable.
  • Don’t try to build 32-bit and 64-bit OpenSSL in the same folder. The first build will leave artifacts that will mess up the second build. (Running a clean isn’t enough, apparently.)
  • Don’t try to build 32-bit OpenSSL inside of Visual Studio’s 64-bit command prompt and vice versa. It doesn’t work.

References

These were very helpful places:

Footnotes:
1. Strawberry Perl has been less reliable historically, but I see the comments for success stories.
2. OpenSSL version 1.0.1c was the latest at the time of writing.
3. 7-zip is good for unzipping .tar.gz files on Windows. It’s a two-step process.
4. OpenSSL’s build scripts are not clever enough to handle two different platform builds in sequence. Separate platform builds must start from scratch.
5. You can find it somewhere in the Start menu.
6. Using ms\\ntdll.mak will build the shared library instead.
7. The /Zi option works, but it’s hard to find the right .pdb file without specifying more options. For the sake of simplicity, the /Z7 option just embeds all the debug symbols into the .lib files. Read more here.
8. For the 64-bit build, Visual Studio uses MASM (ml64.exe) to compile assembly code. According to MASM’s documentation, the /Z7 option is not supported.
Strawberry Perl has been less reliable historically, but I see the comments for success stories.
OpenSSL version 1.0.1c was the latest at the time of writing.
7-zip is good for unzipping .tar.gz files on Windows. It’s a two-step process.
OpenSSL’s build scripts are not clever enough to handle two different platform builds in sequence. Separate platform builds must start from scratch.
You can find it somewhere in the Start menu.
Using ms\\ntdll.mak will build the shared library instead.
The /Zi option works, but it’s hard to find the right .pdb file without specifying more options. For the sake of simplicity, the /Z7 option just embeds all the debug symbols into the .lib files. Read more here.
For the 64-bit build, Visual Studio uses MASM (ml64.exe) to compile assembly code. According to MASM’s documentation, the /Z7 option is not supported.

21 Responses to Building OpenSSL for Visual Studio

  1. Noah says:

    Thanks for documenting this. For the record, Strawberry Perl does not work.

  2. 3noch says:

    Thank you, Noah! I’ve updated the footnote to reflect your input.

  3. erik says:

    Thank you very much for posting this.  My first attempt failed because nasm is not set up right on my machine.  I built it again with no-asm and that worked fine.  I tried 1.0.1c and 1.0.1e, both OK.  -erik

  4. Good staff – thanks. The only trick here is if you rely on MSYS perl instead of ActivePerl: http://stackoverflow.com/questions/7680189/openssl-cant-build-in-vc-2010So both facts allowed me to build LIB files, finally!

  5. Chandra says:

    Thanks a bunch… it helped in our critical time…

  6. Anam Zahid says:

    […] BTW, a very simple and useful procedure is described here and here […]

  7. Mukilan says:

    Hi,I have tried the above steps for the openssl source openssl-fips-2.0.6.tar.gz. But it is not working out. Do i need to follow any other steps for FIPS capable source?.Regards,Mukilan

  8. Robert says:

    These instructions were spot on! Once I had followed these I had a problem still though, which actually turned out to be a commit made a few weeks ago. Since 64-bit windows isn’t a primary concern it broke this build. I found when I reverted these recent changes the build worked fine. Also, when I checked out one of the ‘stable’ branches (rather than ‘master’) it also works fine. So my further recommendation to these above would be to use a ‘stable’ branch rather than main to be assured of not having any problems.There is a ticket open here: https://github.com/openssl/openssl/issues/190

  9. Cristian Cocheci says:

    Great post, thank you. Works with VS 2013 as well.

  10. Ralf says:

    Good documentation. Thanks, works great.

  11. Matt Cobb says:

    With OpenSSL 1.0.2a 32bit build with MASM failed to build sha1-586.asm. (See issue #3650) Using NASM 2.11.8 worked.

  12. komal lalwani says:

    Hi,I tried the above steps of Building the 32-bit static libraries.When I run the command nmake -f ms\nt.mak, it gives the following error : Copying: ./crypto/opensslconf.h to inc32/openssl/opensslconf.h ml /nologo /Cp /coff /c /Cx /Zi /Fotmp32\sha1-586.obj tmp32\sha1-586.asmAssembling: tmp32\sha1-586.asmtmp32\sha1-586.asm(1432) : error A2070:invalid instruction operandstmp32\sha1-586.asm(1576) : error A2070:invalid instruction operandsNMAKE : fatal error U1077: ‘”C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\BIN\ml.EXE”‘ : return code ‘0x1’ Can anyone help me with this error.Thanks in advance.

  13. cashchow says:

    I just tried building 1.0.1o and 1.0.1p and both are failing to finish linking with VC14 (Visual Studio 2015). The last line of the output of the nmake command is:

        link /nologo /subsystem:console /opt:ref /debug /out:out32\constant_time_test.exe @C:\Users\John\AppData\Local\Temp\nmF77B.tmpconstant_time_test.obj : error LNK2019: unresolved external symbol ___iob_func referenced in function _mainout32\constant_time_test.exe : fatal error LNK1120: 1 unresolved externals

  14. Reiner says:

    Had a problem, that stdlib.h was not found. Running “C:\Program Files (x86)\Microsoft Visual Studio 12.0\VC\vcvarsall.bat” fixed it!

  15. […] simplicity, the /Z7 option just embeds all the debug symbols into the .lib files. Read more here. 8. For the 64-bit build, Visual Studio uses MASM (ml64.exe) to compile assembly code. According to […]

  16. Robin Degen says:

    Thanks for the tutorial. Compiled just fine using Strawberry Perl and Visual Studio 2015. You can remove the note about it not working.

  17. Alex Oh says:

    When I runnmake -f ms\nt.mak I get a bunch of errors, one after another, complaining about missing files. Most of the files are within the Windows 8.1 SDK kit, but it says that no such file exists. Same goes for .lib files which exist, but are presumed to be missing by nmake. Anyway that I can include these directories (from the console)?

  18. simon tiong says:

    HI,I am simon. I facing a trouble when following the step. I am compiling for win32bitError: ‘cl’ is not recognized as an internal or external command,Please Advices me.Thank YOu

Leave a reply