How to install OpenSSL on Windows and Windows Server

Short answer: the OpenSSL project publishes source code, not Windows programs, so on Windows you install a build made by someone else. The quickest are winget install ShiningLight.OpenSSL.Light or choco install openssl, and Git for Windows already includes openssl.exe. Open a new terminal and run openssl version to check.

# pick one
winget install --id ShiningLight.OpenSSL.Light -e      # Windows 10/11, Server 2025
choco install openssl -y                              # Chocolatey, any Windows Server

# then, in a NEW window
openssl version
where.exe openssl

This guide explains where each build comes from, how to get openssl onto your PATH, the configuration-file error almost everyone meets, and the Windows jobs OpenSSL is usually installed for: a key and CSR, checking a certificate, and converting a PFX file for IIS to PEM and back. The key, CSR, certificate and PFX commands were run with OpenSSL 3.0.22 on Debian 12, with the output shown; they take the same arguments on Windows. The s_client lines follow the OpenSSL manual.

Why openssl.org has no Windows download

For its whole history the OpenSSL library has been released as source tarballs only. The project’s wiki keeps a “Binaries” page of third parties that build it for Windows and other systems, with a clear disclaimer: the listing “does not imply any endorsement by the OpenSSL project”, and the products “have not been evaluated or tested by the OpenSSL project”. The Windows builds on that page as of October 2026 include Shining Light Productions (the long-standing “Win64 OpenSSL” installers) and FireDaemon.

That is changing. In August 2026 OpenSSL Corporation published the first official Windows installer as a testing release on GitHub (repository openssl/installer): OpenSSL 4.0.1 for x64, as EXE and MSI, with the library, openssl.exe and the development files, and an option to put the tool on your PATH. Its announcement says the stable installer arrives with the 4.1 release. Until then, treat it as a preview and use one of the established builds on a production server.

Ways to get OpenSSL on Windows

The winget IDs are the ones in Microsoft’s winget-pkgs repository on 21 October 2026, where all three were at OpenSSL 4.0.3; the Chocolatey openssl package repackages the Shining Light build. Your own winget search openssl shows the current list, and the ID column is what --id wants.

Install OpenSSL with winget

winget search openssl
winget install --id ShiningLight.OpenSSL.Light -e --source winget --accept-package-agreements --accept-source-agreements

The Shining Light manifest lists the Microsoft Visual C++ 2015+ runtime as a dependency, and winget installs it first. The package goes to C:\Program Files\OpenSSL-Win64 with the tool in its bin folder. Whether that folder lands on your PATH depends on the installer, so check in a new window with where.exe openssl; if it finds nothing, add the folder yourself (see PATH below).

winget is built into Windows 10 (1809 and later), Windows 11 and Windows Server 2025. Windows Server 2022 and 2019 do not include it and Microsoft does not support it there, so on those servers Chocolatey is the simpler route.

Install OpenSSL with Chocolatey

choco install openssl -y
# close this window, open a new one
openssl version

According to its package page, the Chocolatey package adds the OpenSSL bin folder to the machine PATH and sets OPENSSL_CONF to the configuration file it ships, which saves both of the manual steps below. Chocolatey itself is installed with one PowerShell command from chocolatey.org; choco upgrade openssl -y updates it later.

Use the OpenSSL that comes with Git for Windows

If Git for Windows is installed, so is OpenSSL: open Git Bash and run openssl version. It is not on the Windows PATH, so PowerShell and cmd do not see it. To find the executable, for example to call it by its full path from a script:

Get-ChildItem 'C:\Program Files\Git' -Recurse -Filter openssl.exe -ErrorAction SilentlyContinue |
  Select-Object FullName

It usually sits under usr\bin or mingw64\bin. MinGit, the minimal Git distribution some tools bundle, carries the OpenSSL libraries Git needs but can lack openssl.exe itself.

OpenSSL in WSL

Inside WSL you are on Linux, and sudo apt install openssl gives you the distribution’s build, with the same output as on any Debian or Ubuntu server. Microsoft documents WSL for Windows Server 2019 and later (wsl --install on 2022 and 2025, manual steps on 2019). Two catches: wsl --install sets up WSL 2, which runs a small virtual machine and therefore needs virtualization available inside Windows, something a virtual server often does not offer; and files are easiest to reach from both sides under /mnt/c/. For a tool you run now and then, a native build is less work.

Add OpenSSL to PATH

$bin = 'C:\Program Files\OpenSSL-Win64\bin'
$machine = [Environment]::GetEnvironmentVariable('Path', 'Machine')
if ($machine -notlike "*$bin*") {
  [Environment]::SetEnvironmentVariable('Path', "$machine;$bin", 'Machine')
}
# open a NEW window, then:
where.exe openssl

Two things to avoid: setx PATH "%PATH%;..." cuts the value at 1024 characters and mixes the user and machine PATH into one, and editing PATH does nothing for windows that are already open. If where.exe openssl prints more than one line, the first one wins, which is how an old copy shipped with some other program ends up answering instead of the one you just installed.

Check the version and where it looks for files

openssl version          # version and build date
openssl version -d       # OPENSSLDIR: where this build expects openssl.cnf
openssl version -a       # everything, including the platform

OpenSSL 3.0.22 25 Aug 2026 (Library: OpenSSL 3.0.22 25 Aug 2026)
OPENSSLDIR: "/usr/lib/ssl"

On Windows the OPENSSLDIR line names a Windows folder chosen when the build was made. Which series to pick: openssl-library.org lists the release series that still receive fixes; as of October 2026 the long-term-support series there is 3.5, supported until April 2030, and the 4.x series is current. A Windows build of an older series that is no longer on that list gets no security fixes.

“Can’t open openssl.cnf” and OPENSSL_CONF

Commands that read the configuration file, openssl req above all, stop when the file is not where the build expects it. Reproduced on Debian by pointing OPENSSL_CONF at a missing file, the first line reads:

Can't open "/nonexistent/openssl.cnf" for reading, No such file or directory

On Windows the quoted path is the build’s OPENSSLDIR plus /openssl.cnf. Find the configuration file the package shipped and point OPENSSL_CONF at it:

$cnf = Get-ChildItem 'C:\Program Files\OpenSSL-Win64' -Recurse -Include openssl.cnf, openssl.cfg |
  Select-Object -First 1 -ExpandProperty FullName
$cnf          # check that it printed a path
[Environment]::SetEnvironmentVariable('OPENSSL_CONF', $cnf, 'Machine')

For a single command, -config "C:\path\to\openssl.cnf" does the same without touching the environment.

Common jobs on Windows

Create a private key and a CSR

openssl req -new -newkey rsa:2048 -nodes -keyout example.com.key -out example.com.csr -subj "/CN=example.com" -addext "subjectAltName=DNS:example.com,DNS:www.example.com"
openssl req -in example.com.csr -noout -subject -verify

Certificate request self-signature verify OK
subject=CN = example.com

Send the .csr to the certificate authority and keep the .key on the server. -nodes leaves the key unencrypted, which nginx and Apache need to start unattended; for IIS you combine key and issued certificate into a PFX, below. The openssl commands cheat sheet covers self-signed certificates, rand and dgst in more depth.

Check a certificate file or a live server

openssl x509 -in example.com.crt -noout -subject -issuer -dates -ext subjectAltName
openssl x509 -in example.com.crt -noout -fingerprint -sha1

subject=CN = example.com
issuer=CN = example.com
notBefore=Oct 21 20:07:44 2026 GMT
notAfter=Oct 21 20:07:44 2027 GMT
X509v3 Subject Alternative Name:
    DNS:example.com, DNS:www.example.com
sha1 Fingerprint=AE:F2:3E:31:A0:66:D1:39:65:6D:78:9E:7F:EE:54:D2:6F:29:36:3F

The SHA-1 fingerprint is the same value Windows calls the thumbprint (without the colons), which is how you match a file to an entry in Cert:\LocalMachine\My or an IIS binding. For a live server, s_client waits for input after connecting, and Windows has no /dev/null:

openssl s_client -connect example.com:443 -servername example.com -brief < NUL

'' | openssl s_client -connect example.com:443 -servername example.com -brief

Without installing anything, the SSL checker shows a public site’s certificate, chain and expiry from the outside.

Convert PEM to PFX for IIS

openssl pkcs12 -export -out example.com.pfx -inkey example.com.key -in example.com.crt -certfile chain.pem

-certfile adds the intermediate certificates from your CA, so IIS serves the full chain. OpenSSL asks for an export password, which you type again when importing into IIS or with Import-PfxCertificate. OpenSSL 3 encrypts the file with AES-256 by default (openssl pkcs12 -info shows PBES2, PBKDF2, AES-256-CBC). Older Windows versions and some older tools cannot read that, and the import fails, usually claiming the password is wrong. For those, export with the older algorithms:

openssl pkcs12 -export -out example.com.pfx -inkey example.com.key -in example.com.crt -certfile chain.pem -certpbe PBE-SHA1-3DES -keypbe PBE-SHA1-3DES -macalg sha1

Convert PFX to PEM for nginx, Apache or Linux

openssl pkcs12 -in example.com.pfx -nocerts -nodes -out example.com.key
openssl pkcs12 -in example.com.pfx -clcerts -nokeys -out example.com.crt
openssl pkcs12 -in example.com.pfx -cacerts -nokeys -out chain.pem

A PFX made with OpenSSL 1.1.1 or older tools often encrypts the certificates with RC2, which OpenSSL 3 only loads through its legacy provider. Without it, the export stops like this; add -legacy to each command and it goes through:

Error outputting keys and certificates
40178F354F7F0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:../crypto/evp/evp_fetch.c:386:Global default library context, Algorithm (RC2-40-CBC : 0), Properties ()

Errors you meet on Windows

The UTF-16 row deserves a sentence. In Windows PowerShell 5.1, > writes text as UTF-16, so openssl x509 -in a.crt > b.pem produces a file that OpenSSL itself can no longer read. The same file re-encoded as UTF-16 on Debian made OpenSSL 3.0.22 print exactly Could not read certificate from. Every OpenSSL command that writes a file has -out; use it.

When you do not need OpenSSL at all

• Checksums: Get-FileHash file.iso -Algorithm SHA256 in PowerShell, or certutil -hashfile file.iso SHA256 in cmd.
• Reading a certificate: certutil -dump example.com.crt prints subject, issuer, validity and thumbprint.
• A CSR for IIS: IIS Manager’s Server Certificates page, or certreq -new request.inf request.csr, creates the key inside the Windows certificate store, where IIS wants it anyway.

OpenSSL on a Windows server

On a server, install OpenSSL for all users (Chocolatey or the machine-wide MSI), so a scheduled task or a service account finds the same openssl.exe you used over RDP, and keep it updated like any other software that handles keys. On a Windows VPS you are Administrator from the first login, with Windows Server 2022 or 2019 chosen at order time, so each of the routes above is open to you; on those two versions Chocolatey is the one that needs no workaround.

Frequently asked