OpenSSL for Microsoft Windows

OpenSSL 1.1.1 and 3.0 for Windows

OpenSSL is a popular open-source software library that provides a robust, full-featured set of cryptographic functions and tools to secure communications over computer networks. When we build and ship FireDaemon Certify One, FireDaemon Fusion, and FireDaemon Lozenge we try to ensure it contains the most recent version of OpenSSL. We thought it would be useful to make our OpenSSL Binary Distribution available to you to download and use free of charge. The key advantages of using our OpenSSL Binary Distribution for Microsoft Windows over others that are available are:


  • No need to deploy various software tools in order to attempt to compile the source from scratch. Our build scripts are available for free too if you do want to head down that route
  • Single dependency on the Windows Universal C Runtime (CRT) which is included by default in all modern versions of Microsoft Windows. Hence, there is now no need to install or distribute the Windows C++ Redistributable Runtime to use our OpenSSL Binary Distribution
  • Packaged for simple deployment and use case scenarios including standalone, embeddable, deployable, or portable
  • Digitally signed with our Extended Validation (EV) code signing certificate in order to avoid Windows SmartScreen warnings, increase trust by virtue of Sectigo's authentication and verification procedures on us: FireDaemon Technologies Limited, and validatable binary integrity to meet your compliance requirements.  

Table of Contents

Download OpenSSL


Download OpenSSL Binary Distributions for Microsoft Windows
Pre-compiled executables (EXE) and libraries (DLL) for Microsoft Windows Operating Systems. The distributions can be used standalone or integrated into any Windows application. The EXE and DLL are digitally signed with our Extended Validation (EV) code signing certificate. 
OpenSSL 3.0 for Microsoft Windows
March 2023

Git commit openssl-3.1.0-0-ga92271e03a

SHA2-256 9E4591D8C5C344E418C2167C2E047178A809F085B3552299163516D20EA6B844

OpenSSL 1.1.1 for Microsoft Windows February 2023

Git commit OpenSSL_1_1_1t-0-g830bf8e1e4

SHA2-256 618A025DDA61A2BB0D170906A8EA41991049B752F16BA8553DE141B694D05095


OpenSSL 3.0 for Microsoft Windows
February 2023

Git commit openssl-3.0.8-0-g31157bc0b4

SHA2-256 83CF2C7735F04AF150D76824CDB652E42D57D79CB1589913237E780D5CE978A5


OpenSSL 1.1.1 for Microsoft Windows February 2023

Git Commit openssl-3.0.8-0-g31157bc0b4
SHA2-256 DFDC1F76202C360569E6BC347561AFD869AFF76EB7F7B8152250BF8C223A1C15

For 64-bit / Win64 / x64 and 32-bit / Win32 / x86 Microsoft Windows Operating Systems


To calculate / verify download SHA2-256 checksums please use FireDaemon Lozenge


OpenSSL maintains a list of 3rd-party maintained binary distributions of OpenSSL.

Please review our Release Policy before downloading and using this distribution.


OpenSSL ZIP File Installation Instructions

  1. Follow the instructions below if you have downloaded one of the ZIP files above and want to deploy OpenSSL manually (e.g. on the local hard disk or on a USB drive for a portable installation)
  2. Download the appropriate FireDaemon OpenSSL Binary Distribution ZIP file via the links above.
  3. Unpack the contents of the "openssl-1.1" or "openssl-3" or "openssl-3.1.0" folder in the respective ZIP file to a temporary directory (e.g. C:\Temp)
  4. Copy the contents of (i.e. the files and directories contained within) the x64 folder or x86 folder to your target directory (e.g. C:\OpenSSL)
  5. Copy the ssl folder and contents to the target directory (e.g. C:\OpenSSL).


The commands to copy the files correctly from the location where you unpacked the ZIP file (assuming C:\Temp) are as follows:

: For OpenSSL 1.1
cd C:\Temp\openssl-1.1

: For OpenSSL 3.0
cd C:\Temp\openssl-3

: For OpenSSL 3.1
cd C:\Temp\openssl-3.1.0

: Copy the binaries specific to your platform
: Copy 64-bit binaries
robocopy x64 C:\OpenSSL /E

: Copy 32-bit binaries
robocopy x86 C:\OpenSSL /E

: Copy the ssl folder
robocopy ssl C:\OpenSSL\ssl /E

Your directory structure should look as follows:

C:\OpenSSL>dir /b
bin
include
lib
ssl
To use OpenSSL, simply open an elevated Command Prompt then (adjusting the path in OPENSSL_HOME to suit your manual installation):
: You can set OPENSSL_HOME=%~dp0 in a batch script for portable installs
set OPENSSL_HOME=C:\OpenSSL
set OPENSSL_CONF=%OPENSSL_HOME%\ssl\openssl.cnf
set PATH=%OPENSSL_HOME%\bin;%PATH%
cd /d %OPENSSL_HOME%
openssl version -a

To create a certificate signing request and private key using the same environment variables as above :

openssl genrsa -out server.key 4096
openssl req -new -key server.key -out server.csr -sha256
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

OpenSSL Windows Installer Installation Instructions

Instead of downloading the ZIP file, and for convenience, you can download our Windows installer via the link above in the "Download OpenSSL" section. Installation is straightforward. OpenSSL is installed into the following file system locations. These locations are specified during the build and follow OpenSSL's own conventions. Thanks to Advanced Installer for helping us out.

%PROGRAMFILES%\FireDaemon OpenSSL 3
%PROGRAMFILES%\Common Files\FireDaemon SSL 3

OpenSSL Screenshot

Below is a screenshot showing the executed commands at an elevated command prompt:


FireDaemon OpenSSL 3 Command Line


OpenSSL Documentation

Please refer to OpenSSL's documentation.


Checking SSL / TLS Certificate Validity with Certify One

FireDaemon Certify One allows you to audit, check, inspect, and validate SSL / TLS certificates and certificate chains. Fortify also has a browser-based TLS Encryption Check Tool available.


Compiling OpenSSL From Source

Source

We directly pull from OpenSSL's official GitHub repository.


Release Policy

Whenever we release an updated version of FireDaemon Fusion, FireDaemon Certify One, or OpenSSL gets updated with security fixes, we will provide the latest tagged version of the OpenSSL stable branch. The currently deployed OpenSSL library commit versions are listed adjacent to the download links above. Commit is described viz:

git describe --always --tag --long --first-parent --dirty

Compilation and Build Script

The actual command line to build OpenSSL is as follows (where %toolset% is VC-WIN32 and VC-WIN64A respectively):

perl ..\Configure %toolset% no-asm no-ssl3 no-zlib no-comp no-ui-console no-autoload-config --api=1.1.0 --prefix="%installdir%" --openssldir="%commoninstalldir%" -DOPENSSL_NO_DEPRECATED

For reference, the build script used to create the binary distributions is attached to this article. The build script has the following dependencies:

Integrating OpenSSL with Your Visual Studio Project

To use the headers and libraries present in OpenSSL in your Visual Studio project, you will need to configure the properties of your project.


Additional Include Directories

Prepend "C:\Program Files\FireDaemon Open SSL 3\include"; to Property Pages -> C/C++ -> General -> Additional Include Directories in your project per the screenshot below (adjusting the prepended path to suit your installation):


Visual Studio Project Property Pages Additional Include Directories


Additional Library Directories

Prepend "C:\Program Files\FireDaemon Open SSL 3\lib"; to Property Pages -> Linker -> General -> Additional Library Directories in your project per the screenshot below (adjusting the prepended path to suit your installation):


Visual Studio Project Property Pages Additional Library Directories


Privilege Escalation Mitigation

When building OpenSSL, the build scripts bake the default location of the library (ie. the installation directory) and the SSL configuration into the final product. By default, OpenSSL automatically loads the SSL configuration file from the default file system location. This leads to an easily exploitable privilege escalation scenario documented in CVE-2019-12572. Our build of OpenSSL mitigates this flaw using the following preventative measures:

  • The target directories we have chosen are Windows' default system program files directories assuming a 64-bit architecture with a shared configuration file directory common to both x64 and x86:
    • x64: C:\Program Files\FireDaemon OpenSSL, C:\Program Files\Common Files\FireDaemon SSL
    • x86: C:\Program Files (x86)\FireDaemon OpenSSL, C:\Program Files\Common Files\FireDaemon SSL
  • To mitigate security holes even on non-default installations, we build the library such that it doesn't automatically load the SSL configuration. Hence, when using the OpenSSL tools or the DLLs in your products you have to explicitly load the SSL configuration.
  • All FireDaemon software products that utilise OpenSSL initialise the OpenSSL library at runtime using a flag that prevents the loading of the default configuration.


Compatibility and Support Matrix

The table below provides a compatibility and support matrix, mapping specific compatible Microsoft Windows operating system versions to specific FireDaemon OpenSSL software versions.


OpenSSL Versions
OpenSSL 3.1, 3.0, and 1.1.1
Windows Operating System Version32-bit (x86)64-bit (x64)
Windows XP (1)

Windows Vista (1)

Windows 7 (1)

Windows 8 (1)

Windows 8.1 (1)

Windows 10

Windows 11

Server 2008 (2)

Server 2008 R2 (2)

Server 2012

Server 2012 R2

Server 2016

Server 2019

Server 2022


(1) Windows Desktop Operating System is End of Support

(2) Windows Server Operating System is End of Support


Compatible / SupportedThe software product is designed to be installed on the Microsoft Windows operating system version. The operating system version plus software version combination is actively supported by us on the proviso that the 32-bit (x86) version is deployed on a 32-bit (x86) operating system and the 64-bit (x64) version is deployed on a 64-bit (x64) operating system. Please see the License, Warranty, and Support section below.
Compatible / UnsupportedThe software product should install on the Microsoft Windows operating system version. The operating system version plus software version combination is not supported by us. This is typically due to the operating system version reaching End of Support.
Incompatible / UnsupportedThe software product should not or does not install on the Microsoft Windows operating system version or does not work. The operating system version plus software version combination is not supported by us.


License, Warranty, and Support

Our OpenSSL Binary Distribution is free to use and redistribute. Product use, redistribution, and warranty are governed by the OpenSSL License. If you have questions regarding OpenSSL, wish to report bugs, or require implementation guidance please consider joining the OpenSSL Community.


Acknowledgments

This product includes:


Buy SSL / TLS Certificates

Buy SSL / TLS Certificates