Programming

How to Compile OpenSSL 1.1.1 for Apple Silicon

You have an app on the Mac App Store which depends on OpenSSL for receipt validation, among other things. This validation may be done through Receigen, Swifty Receipt Validator, or your own home-grown receipt validation logic.

But Apple recently announced another instruction set that you need to support in your mac app: ARM64. These new machines could come as early as Big Sur’s general availability, which is likely in October 2020. This means that you have about three months left to update your macOS application.

Unfortunately CocoaPods hasn’t offer any OpenSSL distributions for Apple Silicon macintosh computers yet. Sure there are a few pre-compiled ARM64 binaries but those links against iOS frameworks, not macOS.

Wouldn’t it be great if you have your Mac App ready for Apple Silicon on the same day Big Sur is on Golden Master?

• Here are the steps that you need to do to get a copy of OpenSSL ready for inclusion in your Universal 2 application for the Mac: Download OpenSSL 1.1.1g sources. Extract the archive into two different folders, one for Intel and the other for ARM instruction sets, respectively.
• So I have installed new python with brewed openssl and finished this issue on Mac, not yet Ubuntu. On Mac OS X version 10.10 and system python version 2.7.6, my procedure is as follows: $ brew update $ brew install openssl Then you can see openssl version 1.0.1j. $ brew link openssl -force $ brew install python -with-brewed-openssl.

Install PowerShell via Direct Download; Install from binary archives. After installing PowerShell, you should install OpenSSL. OpenSSL is needed for PowerShell remoting and CIM operations. Installation of latest stable release via Homebrew on macOS 10.13 or higher. If the brew command is not found, you need to install Homebrew following their.

Here are the steps that you need to do to get a copy of OpenSSL ready for inclusion in your Universal 2 application for the Mac:

1. Download OpenSSL 1.1.1g sources.
2. Extract the archive into two different folders, one for Intel and the other for ARM instruction sets, respectively.
3. Configure and compile each separately.
4. Join results of the two together to create a Universal Library.

In this article I’m going to assume that you are going to extract OpenSSL sources into sibling folders with the following names:

• openssl-1.1.1g-x86_x64 – for the Intel build.
• openssl-1.1.1g-arm64 – for the ARM build.

Building the Intel Half

Building the x86_64 portion would be straight-forward since this is currently supported by OpenSSL 1.1.1g. You need to extract the OpenSSL sources into a dedicated folder for the architecture, run configure and then make. Optionally set the macOS deployment target if you need your app to run on earlier versions of the operating system.

You can find an example below. Pay special attention on the arguments to the Configure script.

By the time make completes, you should get four files that comprises of the static and dynamic libraries of OpenSSL.

• libssl.1.1.dylib
• libcrypto.1.1.1.dylib
• libssl.a
• libcrypto.a

Building the ARM Half

However the arm64 portion requires changes to OpenSSL’s build configuration as the macOS build of the instruction set is not currently supported by the library.

Having extracted the OpenSSL sources (be sure extract it into a separate location than the one you’ve used to build the Intel portion), then modify file Configurations/10.main.conf to add the macOS arm64 build configuration. Add the following snippet at around line 1560, right under the entry for “darwin64-x86_64-cc”.

(Special thanks to OpenSSL PR 12254 for the above configuration snippet).

When you’re done, the file should look like the following:

Then run Configure and make similar to before. Take note that the Configure script takes a different set of arguments.

By the time make completes, you would get four files that comprises of the static and dynamic libraries of OpenSSL, having the same file names as the ones previously compiled for Intel. This is why you should create a copy for each architecture and compile it in two different folders.

Creating Universal Libraries

Having the libraries compiled for the respective Intel and ARM64 instruction sets, the last step would be combining the two halves of the each library file into their respective universal library files. Use lipo for this, as follows.

When you’re done combining the library files, check them using the file tool and verify that indeed you have a universal library.

If you use OpenSSL for license validation, you should use the static library version. Which are the libcrypto.a and libssl.a files. Static linking reduces the risk of code injection via library replacement. In other words, it’ll be harder to for crackers to replace the OpenSSL libraries inside your app bundle and make your app use their compromised replacement version instead.

Nevertheless if you use OpenSSL as dynamic libraries, then you would need to change its install names be embeddable into your app bundle’s Frameworks folder. Plain compilation of OpenSSL dynamic libraries are meant to be installed in a shared folder.

Use install_name_tool on the dynamic versions of the library files as follows:

As always, it’ll be prudent to check your work. Use otool -D to print the install name of a dynamic library.

Next Steps

In case you’re in a hurry, I’ve compiled these libraries for you that you can download and drop them into your project. These were built on Xcode 12 Beta 4 running on the Apple Silicon version of Big Sur. These library files are temporary stop-gap until OpenSSL officially support Apple Silicon.

This article was tested with Xcode 12 Beta 4 running on the Apple Silicon version of Big Sur Beta 4. You don’t need an Apple Silicon mac to compile libraries or applications for the processor — Xcode 12 can produce ARM64 binaries even when running on Intel macs. However to test the ARM64 half of a Universal Binary you would need an Apple Silicon mac.

An Apple Silicon mac can run both the Intel and the ARM64 portions of a universal binary application. But not the other way around. Intel binaries are emulated under Rosetta 2 on Apple Silicon, but there is no emulation of ARM64 on Intel-based mac.

But even when you don’t have an Apple Silicon Mac (yet), merely compiling for Universal Binary would be a good start. You’ll know which pre-built 3rd party libraries to update, for which OpenSSL is likely one of several. There are likely ARM-related compiler warnings to heed out for.

Why wait? Get your Xcode Beta copy today and start building your Mac app for ARM64!

Until next time.

The following page is a combination of the INSTALL file provided with the OpenSSL library and notes from the field. If you have questions about what you are doing or seeing, then you should consult INSTALL since it contains the commands and specifies the behavior by the development team.

OpenSSL uses a custom build system to configure the library. Configuration will allow the library to set up the recursive makefiles from makefile.org. Once configured, you use make to build the library. You should avoid custom build systems because they often miss details, like each architecture and platform has a unique opensslconf.h and bn.h generated by Configure.

You must use a C compiler to build the OpenSSL library. You cannot use a C++ compiler. Later, once the library is built, it is OK to create user programs with a C++ compiler. But the library proper must be built with a C compiler.

Update Openssl Mac

There are two generations of build system. First is the build system used in OpenSSL 1.0.2 and below. The instructions below apply to it. Second is the build system for OpenSSL 1.1.0 and above. The instructions are similar, but not the same. For example, the second generation abandons the monolithic Configure and places individual configurations in the Configurations directory. Also, the second generation is more platform agnostic and uses templates to produce a final, top level build file (Makefile, descrip.mms, what have you).

After you configure and build the library, you should always perform a make test to ensure the library performs as expected under its self tests. If you are building OpenSSL 1.1.0 and above, then you will also need PERL 5.10 or higher (see README.PERL for details).

OpenSSL's build system does not rely upon autotools or libtool. Also see Why aren't tools like 'autoconf' and 'libtool' used? in the OpenSSL FAQ.

• 2Configuration
• 3Configure Options
• 4Compilation
• 5Platfom specific
  • 5.1Linux
  • 5.2Windows
  • 5.3OpenSSL 1.1.0
  • 5.4OpenSSL 1.0.2
  • 5.6iOS
  • 5.8More

Retrieve source code[edit]

The OpenSSL source code can be downloaded from OpenSSL Source Tarballs or any suitable ftp mirror. There are various versions including stable as well as unstable versions.

The source code is managed via Git. Its referred to as Master. The repository is

git://git.openssl.org/openssl.git

The source is also available via a GitHub mirror. This repository is updated every 15 minutes.

Configuration[edit]

OpenSSL is configured for a particular platform with protocol and behavior options using Configure and config.

You should avoid custom build systems because they often miss details, like each architecture and platform has a unique opensslconf.h and bn.h generated by Configure.

Supported Platforms[edit]

You can run Configure LIST to see a list of available platforms.

If your platform is not listed, then use a similar platform and tune the $cflags and $ldflags by making a copy of the configure line and giving it its own name. $cflags and $ldflags correspond to fields 2 and 6 in a configure line. An example of using a similar configure line is presented in Using RPATHs.

Configure & Config[edit]

You use Configure and config to tune the compile and installation process through options and switches. The difference between is Configure properly handles the host-arch-compiler triplet, and config does not. config attempts to guess the triplet, so its a lot like autotool's config.guess.

You can usually use config and it will do the right thing (from Ubuntu 13.04, x64):

Mac OS X can have issues (its often a neglected platform), and you will have to use Configure:

You can also configure on Darwin by exporting KERNEL_BITS:

If you provide a option not known to configure or ask for help, then you get a brief help message:

And if you supply an unknown triplet:

Dependencies[edit]

If you are prompted to run make depend, then you must do so. For OpenSSL 1.0.2 and below, its required to update the standard distribution once configuration options change.

OpenSSL 1.1.0 and above performs the dependency step for you, so you should not see the message. However, you should perform a make clean to ensure the list of objects files is accurate after a reconfiguration.

Configure Options[edit]

OpenSSL has been around a long time, and it carries around a lot of cruft. For example, from above, SSLv2 is enabled by default. SSLv2 is completely broken, and you should disable it during configuration. You can disable protocols and provide other options through Configure and config, and the following lists some of them.

Note: if you specify a non-existent option, then the configure scripts will proceed without warning. For example, if you inadvertently specify no-sslv2 rather than no-ssl2 no-ssl3, the script will configure with SSLv2 and without warning for the unknown no-sslv2.

Note: when building a shared object, both the static archive and shared objects are built. You do not need to do anything special to build both when shared is specified.

Note: on older OSes, like CentOS 5, BSD 5, and Windows XP or Vista, you will need to configure with no-async when building OpenSSL 1.1.0 and above. The configuration system does not detect lack of the Posix feature on the platforms.

Note: you can verify compiler support for __uint128_t with the following:

PREFIX and OPENSSLDIR[edit]

--prefix and --openssldir control the configuration of installed components. The behavior and interactions of --prefix and --openssldir are slightly different between OpenSSL 1.0.2 and below, and OpenSSL 1.1.0 and above.

The rule of thumb to use when you want something that 'just works' for all recent versions of OpenSSL, including OpenSSL 1.0.2 and 1.1.0, is:

• specify both--prefix and --openssldir
• set --prefix and --openssldir to the same location

One word of caution is avoid--prefix=/usr when OpenSSL versions are notbinary compatible. You will replace the distro's version of OpenSSL with your version of OpenSSL. It will most likely break everything, including the package management system.

OpenSSL 1.0.2 and below

It is usually not necessary to specify --prefix. If --prefix is not specified, then --openssldir is used. However, specifying only--prefix may result in broken builds because the 1.0.2 build system attempts to build in a FIPS configuration.

You can omit If --prefix and use --openssldir. In this case, the paths for --openssldir will be used during configuration. If --openssldir is not specified, the the default /usr/local/ssl is used.

The takeaway is /usr/local/ssl is used by default, and it can be overridden with --openssldir. The rule of thumb applies for path overrides: specify both--prefix and --openssldir.

OpenSSL 1.1.0 and above

OpenSSL 1.1.0 changed the behavior of install rules. You should specify both --prefix and --openssldir to ensure make install works as expected.

The takeaway is /usr/local/ssl is used by default, and it can be overridden with both--prefix and --openssldir. The rule of thumb applies for path overrides: specify both--prefix and --openssldir.

Debug Configuration[edit]

From the list above, its possible to quickly configure a 'debug' build with ./config -d. However, you can often get into a more amicable state without the Electric Fence dependency by issuing:

Don't be alarmed about both -O3 and -O0. The last setting 'sticks', and that's the -O0.

If you are working in Visual Studio and you can't step into library calls, then see Step into not working, but can force stepping after some asm steps on Stack Overflow.

Modifying Build Settings[edit]

Sometimes you need to work around OpenSSL's selections for building the library. For example, you might want to use -Os for a mobile device (rather than -O3), or you might want to use the clang compiler (rather than gcc).

In case like these, its often easier to modify Configure and Makefile.org rather than trying to add targets to the configure scripts. Below is a patch that modifies Configure and Makefile.org for use under the iOS 7.0 SDK (which lacks gcc in /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/):

• Modifies Configure to use clang
• Modifies Makefile.org to use clang
• Modifies CFLAG to use -Os
• Modifies MAKEDEPPROG to use $(CC) -M

Setting and resetting of LANG is required on Mac OSX to work around a sed bug or limitation.

After modification, be sure to dclean and configure again so the new settings are picked up:

Using RPATHs[edit]

RPATH's are supported by default on the BSD platforms, but not others. If you are working on Linux and compatibles, then you have to manually add an RPATH. One of the easiest ways to add a RPATH is to configure with it as shown below.

Note well: you should use a RPATH when building both OpenSSL and your program. If you don't add a RPATH to both, then your program could runtime-link to the wrong version of OpenSSL.

You can also add an RPATH by hard coding the RPATH into a configure line. For example, on Debian x86_64 open the file Configure in an editor, copy linux-x86_64, name it linux-x86_64-rpath, and make the following change to add the -rpath option. Notice the addition of -Wl,-rpath=... in two places.

Above, fields 2 and 6 were changed. They correspond to $cflag and $ldflag in OpenSSL's builds system.

Then, Configure with the new configuration:

Finally, after make, verify the settings stuck:

Once you perform make install, then ldd will produce expected results:

FIPS Capable Library[edit]

If you want to use FIPS validated cryptography, you download, build and install the FIPS Object Module (openssl-fips-2.0.5.tar.gz) according to the FIPS User Guide 2.0 and FIPS 140-2 Security Policy. You then download, build and install the FIPS Capable Library (openssl-1.0.1e.tar.gz).

When configuring the FIPS Capable Library, you must use fips as an option:

If you are configuring the FIPS Capable Library with only prime curves (openssl-fips-ecp-2.0.5.tar.gz), then you must configure with no-ec2m:

Compile Time Checking[edit]

If you disable an option during configure, you can check if it's available through OPENSSL_NO_* defines. OpenSSL writes the configure options to <openssl/opensslconf.h>. For example, if you want to know if SSLv3 is available, then you would perform the following in your code:

Compilation[edit]

After configuring the library, you should run make. If prompted, there's usually no need to make depend since you are building from a clean download.

Quick[edit]

Various options can be found examining the Configure file (there is a well commented block at its top). OpenSSL ships with SSLv2, SSLv3 and Compression enabled by default (see my $disabled), so you might want to use no-ssl2 no-ssl3, no-ssl3, and no-comp.

Platfom specific[edit]

Linux[edit]

Intel[edit]

ARM[edit]

X32 (ILP32)[edit]

X32 uses the 32-bit data model (ILP32) on x86_64/amd64. To properly configure for X32 under current OpenSSL distributions, you must use Configure and use the x32 triplet:

Then:

If using an amd64-compatible processor and GCC with that supports __uint128_t, then you usually add enable-ec_nistp_64_gcc_128 in addition to your other flags.

Upgrade Openssl Mac Without Brew

Windows[edit]

3noch wrote a VERY good guide in 2012 here (PLEASE NOTE: the guide was written in 2012 and is no longer available at the original location; the link now points to an archived version at the Internet Archive Wayback Machine).

Like he said in his article, make absolutely sure to create separate directories for 32 and 64 bit versions.

W32 / Windows NT - Windows 9x[edit]

type INSTALL.W32

• you need Perl for Win32. Unless you will build on Cygwin, you will need ActiveState Perl, available from http://www.activestate.com/ActivePerl.
• one of the following C compilers:
  • Visual C++
  • Borland C
  • GNU C (Cygwin or MinGW)
• Netwide Assembler, a.k.a. NASM, available from http://nasm.sourceforge.net/ is required if you intend to utilize assembler modules. Note that NASM is now the only supported assembler.

W64[edit]

Read first the INSTALL.W64 documentation note containing some specific 64bits information.See also INSTALL.W32 that still provides additonnal build information common to both the 64 and 32 bit versions.

You may be surprised: the 64bit artefacts are indeed output in the out32* sub-directories and bear names ending *32.dll. Fact is the 64 bit compile target is so far an incremental change over the legacy 32bit windows target. Numerous compile flags are still labelled '32' although those do apply to both 32 and 64bit targets.

The important pre-requisites are to have PERL available (for essential file processing so as to prepare sources and scripts for the target OS) and of course a C compiler like Microsoft Visual Studio for C/C++. Also note the procedure changed at OpenSSL 1.1.0 and is more streamlined. Also see Why there is no msdo_ms.bat after perl Configure VC-WIN64A on Stack Overflow.

OpenSSL 1.1.0[edit]

For OpenSSL 1.1.0 and above perform these steps:

1. Ensure you have perl installed on your machine (e.g. ActiveState or Strawberry), and available on your %PATH%
2. Ensure you have NASM installed on your machine, and available on your %PATH%
3. Extract the source files to your folder, here cd c:myPathopenssl
4. Launch Visual Studio tool x64 Cross Tools Command prompt
5. Goto your defined folder cd c:myPathopenssl
6. Configure for the target OS with perl Configure VC-WIN64A or other configurations to be found in the INSTALL file (e.g. UNIX targets).
   1. For instance: perl Configure VC-WIN64A.
7. (Optional) In case you compiled before on 32 or 64-bits, make sure you run nmake clean to prevent trouble across 32 and 64-bits which share output folder.
8. Now build with: nmake
9. Output can be found in the root of your folder as libcrypto-1_1x64.dll and libssl-1_1-x64.dll (with all the build additionals such as .pdb .lik or static .lib). You may check this is true 64bit code using the Visual Studio tool 'dumpbin'. For instance dumpbin /headers libcrypto-1_1x64.dll | more, and look at the FILE HEADER section.
10. Test the code using the 'test' make target, by running nmake test.
11. Reminder, clean your code to prevent issues the next time you compile for a different target. See step 7.

Windows CE[edit]

Not specified

OpenSSL 1.0.2[edit]

For OpenSSL 1.0.2 and earlier the procedure is as follows.

1. Ensure you have perl installed on your machine (e.g. ActiveState or Strawberry), and available on your %PATH%
2. Ensure you have NASM installed on your machine, and available on your %PATH%
3. launch a Visual Studio tool x64 Cross Tools Command prompt
4. change to the directory where you have copied openssl sources cd c:myPathopenssl
5. configure for the target OS with the command perl Configure VC-WIN64A. You may also be interested to set more configuration options as documented in the general INSTALL note (for UNIX targets). For instance: perl Configure VC-WIN64A.
6. prepare the target environment with the command: msdo_win64a
7. ensure you start afresh and notably without linkable products from a previous 32bit compile (as 32 and 64 bits compiling still share common directories) with the command: nmake -f msntdll.mak clean for the DLL target and nmake -f msnt.mak clean for static libraries.
8. build the code with: nmake -f msntdll.mak (respectively nmake -f msnt.mak )
9. the artefacts will be found in sub directories out32dll and out32dll.dbg (respectively out32 and out32.dbg for static libraries). The libcrypto and ssl libraries are still named libeay32.lib and ssleay32.lib, and associated includes in inc32 ! You may check this is true 64bit code using the Visual Studio tool 'dumpbin'. For instance dumpbin /headers out32dll/libeay32.lib | more, and look at the FILE HEADER section.
10. test the code using the various *test.exe programs in out32dll. Use the 'test' make target to run all tests as in nmake -f msntdll.mak test
11. we recommend that you move/copy needed includes and libraries from the '32' directories under a new explicit directory tree for 64bit applications from where you will import and link your target applications, similar to that explained in INSTALL.W32.

Windows CE[edit]

OS X[edit]

The earlier discussion presented a lot of information (and some of it had OS X information). Here are the TLDR versions to configure, build and install the library.

If configuring for 64-bit OS X, then use a command similar to:

If configuring for 32-bit OS X, then use a command similar to:

If you want to build a multiarch OpenSSL library, then see this answer on Stack Overflow: Build Multiarch OpenSSL on OS X.

iOS[edit]

The following builds OpenSSL for iOS using the iPhoneOS SDK. The configuration avoids the dynamic library the DSO interface and engines.

If you run make install, then the headers will be installed in /usr/local/openssl-ios/include and libraries will be installed in /usr/local/openssl-ios/lib.

32-bit[edit]

For OpenSSL 1.1.0 and above, a 32-bit iOS cross-compiles uses the ios-cross target, and options similar to --prefix=/usr/local/openssl-ios.

If you are working with OpenSSL 1.0.2 or below, then use the iphoneos-cross target.

64-bit[edit]

For OpenSSL 1.1.0 , a 64-bit iOS cross-compiles uses the ios64-cross target, and --prefix=/usr/local/openssl-ios64. ios64-cross. There is no built-in 64-bit iOS support for OpenSSL 1.0.2 or below.

Android[edit]

Visit Android and FIPS Library and Android.

More[edit]

VAX/VMS[edit]

I you wonder what are files ending with .com like test/testca.com those are VAX/VMX scripts.This code is still maintained.

OS/2[edit]

NetWare[edit]

5.x 6.x

HP-UX[edit]

Autoconf[edit]

OpenSSL uses its own configuration system, and does not use Autoconf. However, a number of popular projects use both OpenSSL and Autoconf, and it would be useful to detect either OPENSSL_init_ssl or SSL_library_init from libssl. To craft a feature test for OpenSSL that recognizes both OPENSSL_init_ssl and SSL_library_init, you can use the following.

Update Openssl Mac Os

Many thanks to the Postgres folks for donating part of their configure.in. Also see How to tell Autoconf “require symbol A or B” from LIB? on Stack Overflow.

Update Openssl Mac Lion