How to install OpenSSL in windows 10?

Question

I have a question about how and what is the version of OpenSSl that I must install in Windows to later create certificates. Install a one version (openssl-1.0.2d-fips-2.0.10) found in SourceForge but it does not generate the files correctly. There is also the official website https://www.openssl.org, but I do not know how to install it and how, so that when it comes to generating the keys and .pem file, it works. Generate some environment variables that point to the folder where I unzipped the downloaded, I do not know if it is the correct way.

Forestry

What does "but it does not generate the files correctly" mean? Which files? I don't think that the official site exposes the (Win) binaries. There's always the possibility of building it from source :d. I remember that I was able to install and use a downloaded binary on my previous laptop. Now I use a custom version (OpenSSL 1.0.2j-fips 26 Sep 2016) that I built myself. – Obumbrate

wiki.openssl.org/index.php/Binaries – Obumbrate

Whichever suits you best. If it makes no difference to you, then start with the 1st. – Obumbrate

As I told you before, I am a Nobel student so, in my opinion, it counts little, what my computer needs is more important. The question is what is the most appropriate option to work in localhost environment, node.js? – Forestry

Answer 1

I also wanted to create OPEN SSL for Windows 10. An easy way to do it without running into a risk of installing unknown software from 3rd party websites and risking entries of viruses, is by using the openssl.exe that comes inside your Git for Windows installation. In my case, I found the open SSL in the following location of Git for Windows Installation.

C:\Program Files\Git\usr\bin\openssl.exe

If you also want instructions on how to use OPENSSL to generate and use Certificates, here is a write-up on my blog. The step by step instructions first explains how to use Microsoft Windows Default Tool and also OPEN SSL and explains the difference between them.

https://kaushikghosh12.blogspot.com/2016/08/self-signed-certificates-with-microsoft.html

Wilkins

Easy way and fastest if you already have Git. +1 for that.A shortcut would be to directly type your openssl commands inside the Git bash like this openssl req -newkey rsa:2048 -nodes -keyout key.pem -x509 -days 365 -out certificate.pem – Evasive

For some commands, you may need to specify the config location with the -config flag. Mine was at C:\Program Files\Git\usr\ssl\openssl.cnf – Spellbind

if you have Git for Windows, type bash in terminal then you can use openssl command vola – Giuliana

Every time I try the git openssl in git in Windows, it does not complete any output and does not display anything or quit. I am trying to figure That out now... – Deem

type Git in Windows Search bar and you get all the related listing. Then click on Git Bash, then you are in bash shell. – Day

This command hung for 30 minutes, not finishing but just generated a 0KB file: openssl genrsa -des3 -out rootCA.key 2048 So I had to use slproweb.com/products/Win32OpenSSL.html – Footwall

Great answer, Kaushik. Thanks. For folks who may want to find where you may have openssl.exe existing, I'll share that you could use the DOS command where /r \ openssl.exe, or good ol' cd ` and dir /s openssl.exe`. I'm not saying they will be fast, but they'll do the job. – Abie

FWIW, as a slight variant on Kaushik's great answer here, I just offered in another answer a different way to leverage something ELSE that folks might "already have installed", if you have implemented WSL (Windows Subsystem for Linux). In that case, you can use wsl openssl ...whatever.... But I wanted to share a bit more than that alone, thus the other answer. – Abie

This doesn't really answer the question directly. He asked how to install it, not run it. I needed to install it to build something else I pulled from GitHub, so this answer was no help. The answer below, using chocolatey, is the way to go – Theomorphic

Git version 2.31.1 for Windows very likely uses OpenSSL version 1.1.1. Other providers can offer more recent versions. For example, I've found version 3.0.8 from FireDiemon (kb.firedaemon.com/support/solutions/articles/4000121705). – Sobel

Umm... no... I installing Lynx web browser and it requires lybcrypto dll, got right with choco one – Readable

I've the problem on generating certificate from key using github on windows 10. I solved this by using openssl from WSL. – Adam

What if I want libssl-dev? – Urmia

Answer 2

If you have chocolatey installed you can install openssl via a single command i.e.

choco install openssl

Liggitt

I did the same but with Elevated permission that means opening CMD command line using Administrator mode in Windows. – Scape

Answer 3

In case you have Git installed,

you can open the Git Bash (shift pressed + right click in the folder -> Git Bash Here) and use openssl command right in the Bash

Fulllength

Or just run Git Bash from the Start menu if you don't have the shell extension installed. – Fifield

However, when using the Git bash, beware using slashes in parameters, e.g. in openssl's "-subj": #31506658 – Incapable

Answer 4

Do you have Git installed?
You can access openssl command from Git Bash without adding any environment variable.

But, if you want to access the openssl command from Windows cmd, then follow me:

1. Find the path of the bin directory of Git. Normally it is at

C:\Program Files\Git\usr\bin\

2. Then add the path your environment variable (User variables -> Path):

4. Now open a new command prompt (don't use an already opened cmd, because the already opened cmd doesn't know the new environment variable).

Now write:

openssl

Resolvent

I guess not forgetting the \ character at the end is important as well. After I added \ at the end it started working. – Pointed

Answer 5

Either set the openssl present in Git as your default openssl and include that into your path in environmental variables (quick way)

OR

1. Install the system-specific openssl from this link.
2. set the following variable : set OPENSSL_CONF=LOCATION_OF_SSL_INSTALL\bin\openssl.cfg
3. Update the path : set Path=...Other Values here...;LOCATION_OF_SSL_INSTALL\bin

Crescin

By far the best answer that helped me – Deeannadeeanne

Answer 6

Necroposting, but might be useful for others:

• There's always the official page ([OpenSSL.Wiki]: Binaries) which contains useful URLs (pointing to unofficial resources / builds, make sure to read the Important Disclaimer)

• There are other repositories which contain unofficial builds

  • Here I want to mention: [GitHub]: CristiFati/Prebuilt-Binaries - Prebuilt-Binaries/OpenSSL

    • FIPS considerations:

      • v1.0.2u (FIPS capable) is built with OpenSSL-FIPS 2.0.16

      • v3.* also include a FIPS provider (check instructions on how to enable it - e.g. for Nix: [SO]: OpenSSL 3.0.8: FIPS functionality not working with libcrypto library in custom path)

    • Artefacts are .zips that should (typically) be unpacked in:

      • Win: C:\Program Files (C:\Program Files (x86))

      • Nix: /usr/local

      Please take a look at the Readme.md file (and also at the one at the repository root)

• Other (3^rd-party) software may bundle OpenSSL, so it gets "installed" as a side effect. Such software (mentioned by other answers): Conan, Cygwin, Git, MSYS2, VCPkg, WSL (well, this is not actually Win)

• And of course, you can build it yourself from sources, but that requires a little bit deeper knowledge ([GitHub]: openssl/openssl - (master) openssl/NOTES-WINDOWS.md)

Note: when having a functional OpenSSL instance (using whatever method above), here's how you can use it (if you need it into your own projects) from VStudio: [SO]: How to include OpenSSL in Visual Studio (@CristiFati's answer).

Obumbrate

There is nothing "official" about your first link but compiling the list together. All downloads listed there are 3rd party compilations of OpenSSL and thus are not official. The site even states it itself: "Use these OpenSSL derived products at your own risk; these products have not been evaluated or tested by the OpenSSL project." – Liggins

@sigy: The page is official as it's written by the OpenSSL team (and that's what my statement is). Whether it contains pointers to unofficial builds / pages it's a different matter. But, yeah, I should add a note there. – Obumbrate

Answer 7

If you are running Windows 10 1709 (build 16299) or later versions, you can use winget command below to install OpenSSL

winget install -e --id ShiningLight.OpenSSL

Or if you have Git for Windows installed on your system, you can also find OpenSSL in Git file directory.

C:\Program Files\Git\usr\bin\openssl.exe

Hawkinson

Answer 8

Here's a solution that may delight those who have implemented WSL (Windows Subsystem for Linux). You can just use:

wsl openssl ...whatever_args...

The point is that many who've implemented WSL may not realize they can call upon ANY linux command (within their underlying WSL linux vm) right from the DOS or powershell command-line this way. (It's easy to fall into thinking the point of WSL is to use it to "shell into the vm", which is indeed an option, but the power to just run linux commands from Windows is a real value-add of WSL.)

And to be clear, in doing the command as above, whatever file names or folders you may point to (or create) will be relative to the Windows folder from which you run the command. So doing for example, openssl req to create a self-signed cert, where you may name -keyout selfsigned.key -out selfsigned.crt, those two files will be created in the Windows folder where you ran the command.

That said, there are ways this could fall down for some openssl command examples one may find, such as if they tried to use various bash-specific arguments, in which case "shelling into wsl" to run the command may well be the better choice. You could still direct things to be found or placed on the host, but I don't mean this answer to become overly-focused on such WSL aspects. I just wanted to propose it as another alternative to installing openssl.

Abie

I'll add one additional tip: if you may want to use localhost in an openssl command (such as to obtain certs implemented on the host machine), note that localhost "within the vm" (as reached via that wsl openssl command) won't resolve to the host. To get the IP address of the host, you could use wsl ip route, then use THAT ip in place of localhost. – Abie

God only knows why this was marked down. I didn't know you could do this. – Holter

Thanks, Richard. Well, some folks don't care for WSL. Or maybe they didn't like the one negative I noted. Either way, it would be nice if they would step to let us know. In the meantime, you could add a vote up if you like it. So far, theirs is the only vote at all (as the activity history shows). FWIW, I stand by what I shared, however the votes may add up. :-) – Abie

WSL is the best thing Microsoft have done for 20 years. Windows with WSL is something special. – Holter

Answer 9

Open your

Git Bash

Move to your directory if required.

Run your command. eg.

openssl 

Gerthagerti

Thank you!!! ....This is a terrible answer for people who don't have git installed, but it really helped me. – Forint

@Satish Singh, It's not working for me. I got this "bash: openssh: command not found". – Permissive

Answer 10

I recently needed to document how to get a version of it installed, so I've copied my steps here, as the other answers were using different sources from what I recommend, which is Cygwin. I like Cygwin because it is well maintained and provides a wealth of other utilities for Windows. Cygwin also allows you to easily update the versions as needed when vulnerabilities are fixed. Please update your version of OpenSSL often!

Open a Windows Command prompt and check to see if you have OpenSSL installed by entering: openssl version

If you get an error message that the command is NOT recognized, then install OpenSSL by referring to Cygwin following the summary steps below:

Basically, download and run the Cygwin Windows Setup App to install and to update as needed the OpenSSL application:

1. Select an install directory, such as C:\cygwin64. Choose a download mirror such as: http://mirror.cs.vt.edu
2. Enter in openssl into the search and select it. You can also select/un-select other items of interest at this time. The click Next twice then click Finish.
3. After installing, you need to edit the PATH variable. On Windows, you can access the System Control Center by pressing Windows Key + Pause. In the System window, click Advanced System Settings → Advanced (tab) → Environment Variables. For Windows 10, a quick access is to enter "Edit the system environment variables" in the Start Search of Windows and click the button "Environment Variables". Change the PATH variable (double-click on it or Select and Edit), and add the path where your Cywgwin is, e.g. C:\cygwin\bin.
4. Verify you have it installed via a new Command Prompt window: openssl version. For example: C:\Program Files\mosquitto>openssl versionOpenSSL 1.1.1f 31 Mar 2020
   • If not, refer to the Cygwin documentation and also other tutorials such as: https://www.eclipse.org/4diac/documentation/html/installation/cygwin.html

Emia

Answer 11

If you are working on Windows, simply install Git and add Git's bin folder to your system's path by using the following location: C:\Program Files\Git\usr\bin\

1. Edit environment Variables
2. Edit Path
3. Add Git's bin path

Then, just restart your terminal and try again.

Gizzard

This does not answer the question in any way, shape, or form. – Greenwald

By far the easiest – Puri

Answer 12

install gitbash and then you can directly use OpenSSL

Spectrogram

Answer 13

I installed openssl 3.0.0 from https://slproweb.com/products/Win32OpenSSL.html. then I go to windows start ->openssl->Win64 OpenSSL Command Prompt, it opens a window like regular dos window, all I need is to go to the installation folder of openssl.

Eighteenmo

Answer 14

Install scoop then type

scoop install openssl

Lyell

Answer 15

Check openssl tool which is a collection of Openssl from the LibreSSL project and Cygwin libraries (2.5 MB). NB! We're the packager.

One liner to create a self signed certificate:

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout selfsigned.key -out selfsigned.crt

Photophore

Answer 16

Just install the latest version with a simple Installer Script :

if (!(Get-Command -Name Install-OpenSSL -Type ExternalScript -ErrorAction Ignore)) { Install-Script -Name Install-OpenSSL -Repository PSGallery -Scope CurrentUser }
Install-OpenSSL

The script is cross-platform and If you have git's openssl, it will add that to $Env:Path. ie: It won't install another one unless you -Force it to.

I hope this helps :)

Nole

$Host_OS = if ($(Get-Variable IsWindows -Value)) { "Windows" } el ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : ObjectNotFound: – Sectarian

Answer 17

You can download pre-compiled binaries available on SourceForge:

OpenSSL: https://sourceforge.net/projects/openssl-for-windows/

Lu

Hello. Thank you for your contribution, it is a pleasure to have you among us. Maybe you should review how to write a good answer, you might want to review the ways to act in the community to avoid negative votes in the future. If what you are looking for is reputation in your favor, this is not the correct way, check what is reputation Thank you – Forestry

In fact, I was just wanting to help the citizen who opened the topic, I don't see how that would gain me any reputation. If he is asking how to install OpenSSL, he is unaware that it is a portable program, and although the OpenSSL community tries to improve its reputation, it neglects potential users who only need the precompiled binary that is not distributed for Windows. – Lu

Answer 18

As already told by some users, GIT ships those libraries.

You could install it by Winget as follow:

winget install --id Git.Git -e --source winget

Kekkonen

Answer 19

• Replace all the CR with CRLF
• Save the file in UTF-8 format

In Windows, you can use Notepad+ to do this.

This works for me.

Contentment

Answer 20

you can get it from here https://slproweb.com/products/Win32OpenSSL.html

Supported and reqognized by https://wiki.openssl.org/index.php/Binaries

Illuminate