OpenSSL for Microsoft Windows
When we build and ship Certify One and FireDaemon Fusion we try to ensure it contains the most recent version of OpenSSL. We thought it would be useful to make our OpenSSL Binary Distribution available for you to download and use in a standalone fashion or in your own software projects for free.
Table of Contents
TABLE OF CONTENTS
- 1. Download OpenSSL 3.0 or 1.1.1 ZIP File
- 2. Download OpenSSL 3.0 Windows Installer
- 3. Binary Distribution Manual Deployment
- 4. Screenshot
- 5. Checking Certificate Validity with Certify One
- 6. Documentation
- 7. Compiling From Source
- 8. Privilege Escalation Mitigation
- 9. License and Warranty
- 10. Acknowledgments
1. Download OpenSSL 3.0 or 1.1.1 ZIP File
Download OpenSSL Binary Distribution for Microsoft Windows | |
Pre-compiled executables and libraries for Microsoft Windows Operating Systems. The distributions can be used standalone or integrated into any Windows application. The distribution's EXE and DLL files are digitally signed with our Digicert EV Code Signing certificate 'FireDaemon Technologies Limited'. The distributions depend on the Microsoft Visual Studio runtime which is included in the ZIP file. | |
May 2022 | |
For 64-bit / Win64 / x64 / ARM64EC and 32-bit / Win32 / x86 Microsoft Windows Operating Systems OpenSSL maintains a list of 3rd-party maintained binary distributions of OpenSSL. Please review our Release Policy before downloading and using this distribution. |
2. Download OpenSSL 3.0 Windows Installer
Instead of downloading the ZIP file, you can download our Windows installer that will deploy OpenSSL 3 x64 (64-bit). OpenSSL is installed into the following file system locations. These locations are specified during the build and follow OpenSSL's own conventions. Thanks to Advanced Installer for helping us out.
%PROGRAMFILES%\FireDaemon OpenSSL 3
%PROGRAMFILES%\Common Files\FireDaemon SSL 3
3. Binary Distribution Manual Deployment
- Follow the instructions below if you have downloaded one the ZIP files above and want to deploy OpenSSL manually
- Download the appropriate FireDaemon OpenSSL Binary Distribution ZIP file via the links above. Unpack the contents of the "openssl-1.1" or "openssl-3" folder in the ZIP file into your directory of choice (e.g. C:\OpenSSL). Or simply copy the folder to your preferred location on your hard disk drive.
- Install the appropriate Visual Studio C++ Runtime found in the "prerequisites" folder in the "openssl-1.1" or "openssl-3 folder" found in the ZIP file you just unpacked. Install "VC_redist.x64.exe" on 64-bit systems. Install "VC_redist.x86.exe" on 32-bit systems.
- To use OpenSSL, simply open an elevated Command Prompt then (adjusting the path to suit your installation):
C:\OpenSSL\x64\bin\openssl version -a
or to create a certificate signing request and private key (adjusting the paths to suit your installation) :
set OPENSSL_CONF=C:\OpenSSL\ssl\openssl.cnf
C:\OpenSSL\x64\bin\openssl genrsa -out server.key 4096
C:\OpenSSL\x64\bin\openssl req -new -key server.key -out server.csr -sha256
C:\OpenSSL\x64\bin\openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
4. Screenshot
Below is a screenshot showing the executed commands.
5. Checking Certificate Validity with Certify One
Certify One allows you to audit, check, inspect, and validate SSL / TLS certificates and certificate chains. Fortify also has a browser-based TLS Encryption Check Tool available.
6. Documentation
Please refer to OpenSSL's documentation.
7. Compiling From Source
Source
We directly pull from OpenSSL's official GitHub repository.
Release Policy
Whenever we release an updated version of FireDaemon Fusion, Certify One, or OpenSSL gets updated with security fixes, we will provide the latest tagged version of the OpenSSL stable branch. The currently deployed OpenSSL library is version 1.1.1o and 3.0.3 at commit OpenSSL_1_1_1o-0-gca2e0784d and openssl-3.0.3-0-g4d346a188c respectively:
git describe --always --tag --long --first-parent --dirty
Compilation and Build Script
The actual command line to build OpenSSL is as follows (where %toolset% is VC-WIN32 and VC-WIN64A respectively):
perl ..\Configure %toolset% no-asm no-ssl3 no-zlib no-comp no-ui-console no-autoload-config --api=1.1.0 --prefix="%installdir%" --openssldir="%commoninstalldir%" -DOPENSSL_NO_DEPRECATED
For reference, the build script used to create the binary distributions is attached to this article.
Dependencies
The OpenSSL binary distribution depends on the Microsoft Visual Studio runtime. The OpenSSL 1.1.1 binaries are built with the Microsoft Visual C++ (MSVC) 14.29 toolset. The OpenSSL 3 binaries are built with the Microsoft Visual C++ (MSVC) 14.31 toolset. The external dependency creates much smaller modules and .pdb files and integrates nicely with FireDaemon Fusion and Certify One. We believe that this shouldn't be problematic since the MSVC 14.3 runtime is binary compatible with applications built using the MSVC 14.0 or 14.1 runtimes, and once installed the Universal C Runtime (CRT) is subject to automatic Windows updates.
8. Privilege Escalation Mitigation
When building OpenSSL, the build scripts bake the default location of the library (ie. the installation directory) and the SSL configuration into the final product. By default, OpenSSL automatically loads the SSL configuration file from the default file system location. This leads to an easily exploitable privilege escalation scenario documented in CVE-2019-12572. Our build of OpenSSL mitigates this flaw using the following preventative measures:
- The target directories we have chosen are Windows' default system program files directories assuming a 64-bit architecture with a shared configuration file directory common to both x64 and x86:
- x64: C:\Program Files\FireDaemon OpenSSL, C:\Program Files\Common Files\FireDaemon SSL
- x86: C:\Program Files (x86)\FireDaemon OpenSSL, C:\Program Files\Common Files\FireDaemon SSL
- To mitigate security holes even on non-default installations, we build the library such that it doesn't automatically load the SSL configuration. Hence, when using the OpenSSL tools or the DLLs in your products you have to explicitly load the SSL configuration.
- All FireDaemon software products that utilise OpenSSL initialise the OpenSSL library at runtime using a flag that prevents the loading of the default configuration.
9. License and Warranty
Our OpenSSL Binary Distribution is free to use and redistribute. Product use, redistribution, and warranty are governed by the OpenSSL License.
10. Acknowledgments
This product includes:
- Software developed by the OpenSSL Project for use in the OpenSSL Toolkit
- Cryptographic software written by Eric Young
- software written by Tim Hudson.