How do I build OpenSSL statically linked against W

Question

I'm working on a C++ application for Windows that uses OpenSSL 1.0.1e library. I'm on Visual Studio 2008.

For portability reasons my application is statically linked against runtime libraries (/MT and /MTd options). And I don't ship runtime libs with my application.

Per the OpenSSL FAQ, the library is by default linked against multithreaded DLL runtime (/MDd) which is obviously incompatible with my scenario. So to make my program work I've added applink.c to my project. On my dev machine and on most test computers the program works fine.

But unfortunately I've located computers where the app doesn't start. Windows displays error:

The application failed to initialize properly (0xc0150002). Click on OK to
terminate the application. 

I've opened libeay32.dll in Dependency Walker and I see that MSVCR90.dll is not found. So the trick with applink.c doesn't really work for me.

How do I build OpenSSL with /MT or /MTd option?

Answer 1

To build 64-bit OpenSSL statically linked (which results in a single .exe file without any DLLs) with Visual Studio 2015, you will need the following prerequisites:

• Git for Windows. You can download it at https://git-scm.com/download/win. This guide uses version 2.11.0.3.
• Strawberry perl. You can download it at http://strawberryperl.com/ (Warning: ActivePerl is highly not recommended. It will give you strange errors during the process). This guide uses version 5.24.1.1.
• NASM assembler, which is available from http://www.nasm.us/. This guide uses version 2.12.03rc1.

You are expected to install all those tools system-wide and add them to your %PATH% environmental variable.

After you got everything we need, just follow this simple steps:

1. Open VS2015 x64 Native Tools Command Prompt from your Start Menu. You will see command prompt.

2. Create C:\build directory and issue the following command in the command prompt:

   • cd c:\build

3. Download latest zlib & OpenSSL source codes to your build dir by using the following commands:

   • git clone https://github.com/madler/zlib
   • git clone https://github.com/openssl/openssl

4. First we have to build static zlib. To do that first we will need to edit some configuration files:

   • Navigate to the zlib source folder: cd C:\build\zlib

   • Edit the win32\Makefile.msc file:

     1. Find the line starting with CFLAGS
     2. Replace -MD with -GL -MT -Zc:wchar_t-
     3. Find the line starting with LDFLAGS
     4. Replace -debug with -opt:icf -dynamicbase -nxcompat -ltcg /nodefaultlib:msvcrt

5. Build zlib using the following command (should take less than a minute):

   • nmake -f win32/Makefile.msc AS=ml64 LOC="-DASMV -DASMINF -DNDEBUG -I." OBJA="inffasx64.obj gvmat64.obj inffas8664.obj"

6. Copy resulting files to your OpenSSL directory:

   • xcopy zlib.h C:\build\openssl\
   • xcopy zconf.h C:\build\openssl\
   • xcopy zlib.lib C:\build\openssl\
   • xcopy zlib.pdb C:\build\openssl\

7. Navigate to OpenSSL source: cd C:\build\openssl\ and configure it to use static zlib & read configuration files (openssl.cnf) from C:\Windows\ directory.

   • perl Configure VC-WIN64A no-shared zlib no-zlib-dynamic threads --prefix=C:\Windows\

8. Now make the following edits to the C:\build\openssl\makefile:

   • Find the line that starts with: CFLAG
   • Append: /Zc:wchar_t- /GL /Zi
   • Find the line that starts with: LDFLAGS
   • Replace /debug with /incremental:no /opt:icf /dynamicbase /nxcompat /ltcg /nodefaultlib:msvcrt
   • Find the line that starts with: EX_LIBS
   • Replace ZLIB1 with zlib.lib
   • Save changes

9. Build OpenSSL by issuing the nmake command (will take around 15 minutes).

The resulting ~3MB openssl.exe file will be located at C:\build\openssl\apps\ directory. It is fully portable, since all DLLs are included. If you need to use custom configuration file, copy C:\build\openssl\apps\openssl.cnf to your C:\Windows\ directory & edit it to your liking.

Answer 2

Use the nt.mak makefile rather than the ntdll.mak makefile.

As an aside, I have written some scripts around the standard OpenSSL build scripts which make it 'easier' (for me at least) to use OpenSSL on Windows with a mix of both x86 and x64, you can get them from here.

Answer 3

It appears OpenSSL now links with -MT -Zl (at least when using msvc) meaning it discards default named libraries which are then decided in your final binary. Applications appear to use the static runtime by default.

In other words, no action needs to be taken in order to use it with your binary, just provide whatever flag you want and the OpenSSL library will just work with it. Unfortunate there isn't a lot of concrete documentation on building such an important library.

Answer 4

If you want precompiled OpenSSL libraries with MT look here: http://www.npcglib.org/~stathis/blog/precompiled-openssl/ You will find a patch for the OpenSSL sources that enables producing libraries with suffixes MT/MD and "d" for debug to make identifying the libraries easier.

What's more, you will also find the actual build script to build all of them at once for many different version of Visual Studio. I build and use them myself to exactly produce binaries that need no DLLs for my projects and you may find them useful.

Answer 5

The most elegant option I have found for Windows involves using the scripts provided at http://p-nand-q.com/programming/windows/building_openssl_with_visual_studio_2013.html

They provide scripts for VS2010/VS2013/VS2015 for each script version it builds all combinations of x86/x86-64 with runtimes MDd/MD/MTd/MT.

Quoting the instructions:

PREREQUISITES:

The script assumes you are on Windows.

The script assumes you have Visual Studio 2010, 2013 or 2015 installed in all the usual places. Important: If you have a different installation folder, your mileage may vary

The script assumes you have downloaded an OpenSSL tarball, like this one.

The script assumes you have Python (2.7 or 3.x) installed and on your PATH

The script assumes you have 7-zip installed (doesn't need to be on your PATH) Choose the script you want to use and edit it. For example, let's take a look at the top of rebuild_openssl_vs2015.cmd:

T:

set OPENSSL_VERSION=1.0.1p

set SEVENZIP="C:\Program Files\7-Zip\7z.exe"

set VS2015="C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\bin\vcvars32.bat"

set VS2015_AMD64="C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\bin\amd64\vcvars64.bat"

so it is pretty easy to see: you must enter the OpenSSL version manually, the rest should have sensible defaults...

Note: The script uses the SUBST T:\ drive for building OpenSSL.

I tested and it works, in less than 10 min! KUDOS for the authors of the scripts!!

UPDATE: For the x64 builds to be generated you need to install nasm assembler and have it in the PATH.