Compiling the openssl binary statically

Question

The openssl binary generated by the config & make commands when building from the source tarball is dynamically linked to these libraries:

    linux-vdso.so.1 =>  (0x00007fffa75fe000)
    libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007ff7f79ab000)
    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007ff7f75e2000)
    /lib64/ld-linux-x86-64.so.2 (0x00007ff7f7bd2000)

My guess is if I can link statically to lib gcc, the dependencies on the other shared libraries will disappear too.

Question is how do I get the Configure script to generate a statically linked binary?

Will the process be the same for building on Windows as well?

Another option is to allow dynamic linking, but use a RPATH. For that, see [Compilation and Installation | Using RPATHs](https://wiki.openssl.org/index.php/Compilation_and_Installation#Using_RPATHs) on the OpenSSL wiki. Or see [Build OpenSSL with RPATH?](http://stackoverflow.com/q/29858870) on Stack Overflow. — jww, Jun 18 '15 at 22:48

score 5 · Answer 1 · answered Oct 12 '18 at 13:09

5

What worked for me is to pass -static and --static to the ./config step. --no-shared seems documented in INSTALL but led to build failures. -static by itself also led to build failures.

./config --static -static

answered Oct 12 '18 at 13:09

mppf

1,820
9
9

Paul Tobias · Answer 2 · 2021-02-19T07:58:00.607

Get the source. I used git because I find it easier, but downloading the source tar.gz works too:

$ git clone git://git.openssl.org/openssl.git
Cloning into 'openssl'...
remote: Counting objects: 394745, done.
remote: Compressing objects: 100% (102341/102341), done.
remote: Total 394745 (delta 288534), reused 387444 (delta 281591)
Receiving objects: 100% (394745/394745), 92.39 MiB | 911.00 KiB/s, done.
Resolving deltas: 100% (288534/288534), done.
Updating files: 100% (24047/24047), done.

Check the remote branches (git branch -r) or tags (git tag) and choose the version to build. I used the latest 1.1.1j:

$ cd openssl
$ git checkout OpenSSL_1_1_1j
Note: switching to 'OpenSSL_1_1_1j'.
...
HEAD is now at 52c587d60b Prepare for 1.1.1j release

Run ./config with the -static parameter.

$ ./config -static
Operating system: x86_64-whatever-linux2
Configuring OpenSSL version 1.1.1j (0x101010afL) for linux-x86_64
Using os-specific seed configuration
Creating configdata.pm
Creating Makefile

**********************************************************************
***                                                                ***
***   OpenSSL has been successfully configured                     ***
***                                                                ***
***   If you encounter a problem while building, please open an    ***
***   issue on GitHub <https://github.com/openssl/openssl/issues>  ***
***   and include the output from the following command:           ***
***                                                                ***
***       perl configdata.pm --dump                                ***
***                                                                ***
***   (If you are new to OpenSSL, you might want to consult the    ***
***   'Troubleshooting' section in the INSTALL file first)         ***
***                                                                ***
**********************************************************************

I got this -static parameter from the INSTALL file:

    -Dxxx, -Ixxx, -Wp, -lxxx, -Lxxx, -Wl, -rpath, -R, -framework, -static
                     These system specific options will be recognised and
                     passed through to the compiler to allow you to define
                     preprocessor symbols, specify additional libraries, library
                     directories or other compiler options. It might be worth
                     noting that some compilers generate code specifically for
                     processor the compiler currently executes on. This is not
                     necessarily what you might have in mind, since it might be
                     unsuitable for execution on other, typically older,
                     processor. Consult your compiler documentation.

Compile:

$ make -j`nproc`
...

Check if it's a static binary:

$ ldd apps/openssl
    not a dynamic executable
$ file apps/openssl
apps/openssl: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, BuildID[sha1]=286e4615c57e3c21b8e566eb2a046353fe2308c0, for GNU/Linux 3.2.0, with debug_info, not stripped

No need to manually edit the Makefile. Unfortunately I don't know how to do it on Windows.

score 2 · Answer 3 · answered Jun 18 '15 at 21:30

I wasn't able to get the above solution to work. The linker threw errors about _dlopen being undefined.

I added the no-shared option to the config line, and this built openssl statically linked to the openssl libraries.

It is still dependent on libsocket.so.2, linnsl.so, libz.so, and libc.so.1

score 1 · Answer 4 · answered Dec 16 '13 at 15:34

I came across this post while searching for the same exact thing. I do not know the proper syntax to get the configure script to do this, but this is how I achieved it.

cd /tmp
wget http://www.openssl.org/source/openssl-1.0.1e.tar.gz
tar -zxvf openssl-1.0.1e.tar.gz
cd openssl-1.0.1e
./config

I then Added "-static -static-libgcc" to the CFLAG line of openssl-1.0.1e/Makefile (Note this was AFTER I ran ./config). Then I built it like normal.

make INSTALL_PREFIX=/tmp/package-root install

it is now statically compiled

$ ldd /tmp/package-root/usr/local/ssl/bin/openssl
        not a dynamic executable

un-CharlieH · Answer 5 · 2020-08-28T16:24:07.243

1

For Windows I successfully used this sequence

clone OpenSSL_1_1_1-static branch
Follow Windows instructions to install Perl, Netwide Assembler (NASM); add these exe's into PATH
Using Visual Studio 2017 command prompt; cd openssl
perl Configure VC-WIN32 /MT
- Note: -static is invalid for Windows
edit makefile, find '/MD' flag and remove it (/MT will be used)
nmake
- nmake test
- nmake install

Then link libraries libcrypto_static.lib, libssl_static.lib to your program, which also must be compiled with /MT (/MTd for debug).

Other Visual Studio compiler versions should work the same.

Note: depending on the use case, the flag -D"OPENSSL_USE_APPLINK" may need to be removed from the makefile and the static libraries recompiled.

edited Aug 28 '20 at 16:24

answered Aug 26 '20 at 23:20

un-CharlieH

85
7

The following succeeds in configuring OpenSSL 1.1.1s for a static library build on Windows, with the appropriate NASM (in the PATH), from the appropriate Visual Studio 2022 x86/x64 Native Tools Command Prompt: `perl Configure --debug VC-WIN32 no-shared` (for Debug Win32) `perl Configure VC-WIN32 no-shared` (for Release Win32) `perl Configure --debug VC-WIN64A no-shared` (for Debug x64) `perl Configure VC-WIN64A no-shared` (for Release X64) – MikeOnline Nov 15 '22 at 02:56

Compiling the openssl binary statically

5 Answers5

Linked