Table of Contents

• About OpenSSL
• Download OpenSSL
• Installing OpenSSL
  • Windows Installer
  • Winget Package Manager
  • ZIP File
• OpenSSL Screenshot
• OpenSSL Documentation
• Checking SSL / TLS Certificate Validity with Certify One
• Compiling OpenSSL From Source
  • Release Policy
  • Source
  • Build Script
  • Compilation
• Integrating OpenSSL with Your Visual Studio Project
  • Additional Include Directories
  • Additional Library Directories
• Privilege Escalation Mitigation
• Compatibility and Support Matrix
• License, Warranty, and Support
• Acknowledgments
• Buy SSL / TLS Certificates

About OpenSSL

OpenSSL is a popular open-source, publicly available software library that provides a robust, full-featured set of cryptographic functions and tools to secure communications over computer networks. When we build and ship FireDaemon Certify One, FireDaemon Fusion, and FireDaemon Lozenge we try to ensure it contains the most recent version of OpenSSL. We thought it would be useful to make our OpenSSL Binary Distribution available to you to download and use free of charge. The key advantages of using our OpenSSL Binary Distribution for Microsoft Windows over others that are available are:

• No need to deploy various software tools to attempt to compile the source from scratch. Our build script is available for free too if you do want to compile OpenSSL yourself.
• No external dependencies. There is no need to install or distribute the Visual C++ Redistributable Runtime (MSVC). There is an implicit dependency on the Windows Universal C Runtime (UCRT) which is included by default in all modern versions of Microsoft Windows.
• Packaged for simple deployment and use case scenarios including standalone, embeddable, deployable, or portable
• Digitally signed with our Extended Validation (EV) code signing certificate to avoid Windows SmartScreen warnings, and increase trust by Sectigo's authentication and verification procedures on us: FireDaemon Technologies Limited and validatable binary integrity to meet your compliance requirements.

Download OpenSSL

Download OpenSSL Binary Distributions for Microsoft Windows
OpenSSL 3.3.1 Windows Installer (x64) June 2024 SHA2-256 D0A09BD48D9E717852C024B22D5D1A14B6D88BBC21C3C4879C4FDC6D62533599 Git commit openssl-3.3.1-0-gdb2ac4f6eb	OpenSSL 3.3.1 ZIP File (x64/x86)  June 2024 SHA2-256 DD4FC121DCFFA4BCB89012ACFF0304A4499B06DB4874289F871D9D7BA5BCF12F Git commit openssl-3.3.1-0-gdb2ac4f6eb
OpenSSL 3.0.14 LTS ZIP File (x64/x86) June 2024 SHA2-256 35073B4956EAD392B33AE9DE68FCDB85A07EBA7959338FA43CCE1ADAEF7221D0 Git commit openssl-3.0.14-0-g9cff14fd97	OpenSSL 1.1.1w LTS ZIP File (x64/x86)  September 2023 SHA2-256 1870B15BF6749E65FFBBADF52CDFF3EE0E9F02943550BF4395574BB432AF3EB8 Git commit OpenSSL_1_1_1w-0-ge04bd3433f
To calculate/verify the SHA2-256 checksums please use FireDaemon Lozenge! OpenSSL maintains a list of 3rd-party maintained binary distributions of OpenSSL. Please review our Release Policy before downloading and using this distribution. OpenSSL 1.1.1y or later is only available to OpenSSL customers that have a Premium Support Contract. We no longer supply OpenSSL 3.1 or 3.2 binaries. Please use the latest 3.3 or 3.0 LTS release. 1.1.1 is end of life.

Installing OpenSSL

Windows Installer

You can download the Windows installers found in the "Download OpenSSL" section above. Installation is straightforward. OpenSSL is installed into the following file system locations. These locations are specified during the build and follow OpenSSL's conventions.

%PROGRAMFILES%\FireDaemon OpenSSL 3
%PROGRAMFILES%\Common Files\FireDaemon SSL 3

FireDaemon-OpenSSL-x64-3.3.1.exe /exenoui /exelog fdopenssl3.log /qn /norestart REBOOT=ReallySuppress APPDIR="C:\Program Files\FireDaemon OpenSSL 3" ADJUSTSYSTEMPATHENV=yes

:: To uninstall at an elevated command prompt, first verify the product GUID
wmic product where name="FireDaemon OpenSSL 3" get IdentifyingNumber

:: Then uninstall silently using msiexec
msiexec /x {6CE7A11C-A4C5-43BD-8A95-3232D72B95B5} /quiet /noreboot

:: You can also use the original FireDaemon OpenSSL installer
FireDaemon-OpenSSL-x64-3.3.1.exe /x // /quiet

:: Or uninstall using PowerShell
$app = Get-WmiObject Win32_Product | where { $_.name -eq "FireDaemon OpenSSL 3" }
$app.Uninstall()

Winget Package Manager

Instead of downloading and installing the Windows Installer, you can use the Microsoft package manager called winget. Winget is built into Windows 10 and 11 or can be installed manually. To install FireDaemon OpenSSL, simply open a command prompt on your computer then:

:: Search for FireDaemon OpenSSL
winget search FireDaemon.OpenSSL

:: Show the FireDaemon OpenSSL package contents
winget show FireDaemon.OpenSSL

:: Install FireDaemon OpenSSL interactively
winget install FireDaemon.OpenSSL --interactive

:: Install FireDaemon OpenSSL silently (default)
winget install FireDaemon.OpenSSL --silent

:: Show installed packages
winget list FireDaemon

:: Uninstall FireDaemon OpenSSL
winget uninstall FireDaemon.OpenSSL

ZIP File

Instead of using the installer or package manager, you can download one of the ZIP files found in the "Download OpenSSL" section above.  

1. Follow the instructions below if you have downloaded one of the ZIP files above and want to deploy OpenSSL manually (e.g. on the local hard disk or a USB drive for a portable installation)
2. Download the appropriate FireDaemon OpenSSL Binary Distribution ZIP file via the links above.
3. Unpack the contents of the folder found in the ZIP file to a temporary directory (e.g. C:\Temp)
4. Copy the contents (i.e. the files and directories contained within) of the x64 folder or x86 folder to your target directory (e.g. C:\OpenSSL)
5. Copy the ssl folder and contents to the target directory (e.g. C:\OpenSSL).

The commands to copy the files correctly from the location where you unpacked the ZIP file (assuming C:\Temp) are as follows:

: For OpenSSL 1.1.1 LTS
cd C:\Temp\openssl-1.1

: For OpenSSL 3.0 LTS
cd C:\Temp\openssl-3.0

: For OpenSSL 3.3
cd C:\Temp\openssl-3

: Copy the binaries specific to your platform
: Copy 64-bit binaries
robocopy x64 C:\OpenSSL /E

: Or, copy 32-bit binaries. Don't copy both!
robocopy x86 C:\OpenSSL /E

: Copy the ssl folder
robocopy ssl C:\OpenSSL\ssl /E

C:\OpenSSL>dir /b
bin
include
lib
ssl

: You can set OPENSSL_HOME=%~dp0 in a batch script for portable installs
set OPENSSL_HOME=C:\OpenSSL
set OPENSSL_CONF=%OPENSSL_HOME%\ssl\openssl.cnf
set PATH=%OPENSSL_HOME%\bin;%PATH%
cd /d %OPENSSL_HOME%
openssl version -a

To create a certificate signing request and private key using the same environment variables as above:

openssl genrsa -out server.key 4096
openssl req -new -key server.key -out server.csr -sha256
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

Please refer to OpenSSL's documentation.

Checking SSL / TLS Certificate Validity with Certify One

FireDaemon Certify One allows you to audit, check, inspect, and validate SSL / TLS certificates and certificate chains. Fortify also has a browser-based TLS Encryption Check Tool available.

Compiling OpenSSL From Source

Release Policy

Whenever we release an updated version of FireDaemon Fusion, FireDaemon Certify One, or OpenSSL gets updated with security fixes, we will provide the latest tagged version of the OpenSSL stable branch. The currently deployed OpenSSL library commit versions are listed underneath the download links above. Commit is described viz:

git describe --always --tag --long --first-parent --dirty

Source

We directly pull from OpenSSL's official GitHub repository.

Build Script

You can use our build script to create the binary distributions. The build script has the following dependencies:

• Visual Studio Community Edition
• Git for Windows
• Strawberry Perl.

Compilation

The actual command line to build OpenSSL is as follows (where %toolset% is VC-WIN32 and VC-WIN64A respectively):

perl ..\Configure %toolset% no-asm no-ssl3 no-zlib no-comp no-autoload-config --api=1.1.0 --prefix="%installdir%" --openssldir="%commoninstalldir%" -DOPENSSL_NO_DEPRECATED

Integrating OpenSSL with Your Visual Studio Project

To use the headers and libraries present in OpenSSL in your Visual Studio project, you will need to configure the properties of your project.

Additional Include Directories

Prepend "C:\Program Files\FireDaemon Open SSL 3\include"; to Property Pages -> C/C++ -> General -> Additional Include Directories in your project per the screenshot below (adjusting the prepended path to suit your installation):

Additional Library Directories

Prepend "C:\Program Files\FireDaemon Open SSL 3\lib"; to Property Pages -> Linker -> General -> Additional Library Directories in your project per the screenshot below (adjusting the prepended path to suit your installation):

Privilege Escalation Mitigation

When building OpenSSL, the build scripts bake the default location of the library (ie. the installation directory) and the SSL configuration into the final product. By default, OpenSSL automatically loads the SSL configuration file from the default file system location. This leads to an easily exploitable privilege escalation scenario documented in CVE-2019-12572. Our build of OpenSSL mitigates this flaw using the following preventative measures:

• The target directories we have chosen are Windows' default system program files directories assuming a 64-bit architecture with a shared configuration file directory common to both x64 and x86:
  • x64: C:\Program Files\FireDaemon OpenSSL, C:\Program Files\Common Files\FireDaemon SSL
  • x86: C:\Program Files (x86)\FireDaemon OpenSSL, C:\Program Files\Common Files\FireDaemon SSL
• To mitigate security holes even on non-default installations, we build the library such that it doesn't automatically load the SSL configuration. Hence, when using the OpenSSL tools or the DLLs in your products you have to explicitly load the SSL configuration.
• All FireDaemon software products that utilise OpenSSL initialise the OpenSSL library at runtime using a flag that prevents the loading of the default configuration.

Compatibility and Support Matrix

The table below provides a compatibility and support matrix, mapping specific compatible Microsoft Windows operating system versions to specific FireDaemon OpenSSL software versions.

(1) Windows Desktop Operating System is End of Support

(2) Windows Server Operating System is End of Support

License, Warranty, and Support

Our OpenSSL Binary Distribution is free to use and redistribute. Product use, redistribution, and warranty are governed by the OpenSSL License. If you have questions regarding OpenSSL, wish to report bugs, or require implementation guidance please consider joining the OpenSSL Community.

Acknowledgments

This product includes:

• Software developed by the OpenSSL Project for use in the OpenSSL Toolkit
• Cryptographic software written by Eric Young
• Software written by Tim Hudson.

Buy SSL / TLS Certificates