You can install cryptography
with pip
:
$ pip install cryptography
Supported platforms¶
Currently we test cryptography
on Python 2.7, 3.6+,PyPy 7.3.1, and PyPy3 7.3.1 on these operating systems.
- x86-64 CentOS 7.x
- x86-64 & AArch64 CentOS 8.x
- x86-64 Fedora (latest)
- x86-64 macOS 10.15 Catalina
- x86-64 & AArch64 Ubuntu 18.04, 20.04
- x86-64 Ubuntu rolling
- x86-64 Debian Stretch (9.x), Buster (10.x), Bullseye (11.x), and Sid(unstable)
- x86-64 Alpine (latest)
- 32-bit and 64-bit Python on 64-bit Windows Server 2019
We test compiling with clang
as well as gcc
and use the followingOpenSSL releases:
OpenSSL 1.1.0-latest
OpenSSL 1.1.1-latest
Building cryptography on Windows¶
The wheel package on Windows is a statically linked build (as of 0.5) so alldependencies are included. To install cryptography
, you will typicallyjust run
$ pip install cryptography
If you prefer to compile it yourself you’ll need to have OpenSSL installed.You can compile OpenSSL yourself as well or use a binary distribution.Be sure to download the proper version for your architecture and Python(VC2010 works for Python 2.7 while VC2015 is required for 3.6 and above).Wherever you place your copy of OpenSSL you’ll need to set the LIB
and INCLUDE
environment variables to include the proper locations. For example:
C:\> \path\to\vcvarsall.bat x86_amd64C:\> set LIB=C:\OpenSSL-win64\lib;%LIB%C:\> set INCLUDE=C:\OpenSSL-win64\include;%INCLUDE%C:\> pip install cryptography
As of OpenSSL 1.1.0 the library names have changed from libeay32
andssleay32
to libcrypto
and libssl
(matching their names on all otherplatforms). cryptography
links against the new 1.1.0 names by default. Ifyou need to compile cryptography
against an older version then you mustset CRYPTOGRAPHY_WINDOWS_LINK_LEGACY_OPENSSL
or else installation will fail.
If you need to rebuild cryptography
for any reason be sure to clear thelocal wheel cache.
Building cryptography on Linux¶
cryptography
ships manylinux
wheels (as of 2.0) so all dependenciesare included. For users on pip 8.1 or above running on a manylinux1
ormanylinux2010
compatible distribution (almost everything except Alpine)all you should need to do is:
$ pip install cryptography
If you are on Alpine or just want to compile it yourself thencryptography
requires a compiler, headers for Python (if you’re notusing pypy
), and headers for the OpenSSL and libffi
librariesavailable on your system.
Alpine¶
Replace python3-dev
with python-dev
if you’re using Python 2.
$ sudo apk add gcc musl-dev python3-dev libffi-dev openssl-dev
If you get an error with openssl-dev
you may have to use libressl-dev
.
Debian/Ubuntu¶
Replace python3-dev
with python-dev
if you’re using Python 2.
$ sudo apt-get install build-essential libssl-dev libffi-dev python3-dev
RHEL/CentOS¶
$ sudo yum install redhat-rpm-config gcc libffi-devel python-devel \ openssl-devel
Building¶
You should now be able to build and install cryptography. To avoid gettingthe pre-built wheel on manylinux
compatible distributions you’ll need touse --no-binary
.
$ pip install cryptography --no-binary cryptography
Using your own OpenSSL on Linux¶
Python links to OpenSSL for its own purposes and this can sometimes causeproblems when you wish to use a different version of OpenSSL with cryptography.If you want to use cryptography with your own build of OpenSSL you will need tomake sure that the build is configured correctly so that your version ofOpenSSL doesn’t conflict with Python’s.
The options you need to add allow the linker to identify every symbol correctlyeven when multiple versions of the library are linked into the same program. Ifyou are using your distribution’s source packages these will probably bepatched in for you already, otherwise you’ll need to use options something likethis when configuring OpenSSL:
$ ./config -Wl,--version-script=openssl.ld -Wl,-Bsymbolic-functions -fPIC shared
You’ll also need to generate your own openssl.ld
file. For example:
OPENSSL_1.1.0E_CUSTOM { global: *;};
You should replace the version string on the first line as appropriate for yourbuild.
Static Wheels¶
Cryptography ships statically-linked wheels for macOS, Windows, and Linux (viamanylinux
). This allows compatible environments to use the most recentOpenSSL, regardless of what is shipped by default on those platforms. SomeLinux distributions (most notably Alpine) are not manylinux
compatible sowe cannot distribute wheels for them.
However, you can build your own statically-linked wheels that will work on yourown systems. This will allow you to continue to use relatively old Linuxdistributions (such as LTS releases), while making sure you have the mostrecent OpenSSL available to your Python programs.
To do so, you should find yourself a machine that is as similar as possible toyour target environment (e.g. your production environment): for example, spinup a new cloud server running your target Linux distribution. On this machine,install the Cryptography dependencies as mentioned in Building cryptography on Linux.Please also make sure you have virtualenv installed: this should beavailable from your system package manager.
Then, paste the following into a shell script. You’ll need to populate theOPENSSL_VERSION
variable. To do that, visit openssl.org and find thelatest non-FIPS release version number, then set the string appropriately. Forexample, for OpenSSL 1.0.2k, use OPENSSL_VERSION="1.0.2k"
.
When this shell script is complete, you’ll find a collection of wheel files ina directory called wheelhouse
. These wheels can be installed by asufficiently-recent version of pip
. The Cryptography wheel in thisdirectory contains a statically-linked OpenSSL binding, which ensures that youhave access to the most-recent OpenSSL releases without corrupting your systemdependencies.
set -eOPENSSL_VERSION="VERSIONGOESHERE"CWD=$(pwd)virtualenv env. env/bin/activatepip install -U setuptoolspip install -U wheel pipcurl -O https://www.openssl.org/source/openssl-${OPENSSL_VERSION}.tar.gztar xvf openssl-${OPENSSL_VERSION}.tar.gzcd openssl-${OPENSSL_VERSION}./config no-shared no-ssl2 no-ssl3 -fPIC --prefix=${CWD}/opensslmake && make installcd ..CFLAGS="-I${CWD}/openssl/include" LDFLAGS="-L${CWD}/openssl/lib" pip wheel --no-binary :all: cryptography
Building cryptography on macOS¶
Note
If installation gives a fatal error: 'openssl/aes.h' file not found
see the FAQ for information about how to fix this issue.
The wheel package on macOS is a statically linked build (as of 1.0.1) so forusers with pip 8 or above you only need one step:
$ pip install cryptography
If you want to build cryptography yourself or are on an older macOS version,cryptography requires the presence of a C compiler, development headers, andthe proper libraries. On macOS much of this is provided by Apple’s Xcodedevelopment tools. To install the Xcode command line tools (on macOS 10.10+)open a terminal window and run:
$ xcode-select --install
This will install a compiler (clang) along with (most of) the requireddevelopment headers.
You’ll also need OpenSSL, which you can obtain from Homebrew or MacPorts.Cryptography does not support Apple’s deprecated OpenSSL distribution.
To build cryptography and dynamically link it:
$ brew install openssl@1.1$ env LDFLAGS="-L$(brew --prefix openssl@1.1)/lib" CFLAGS="-I$(brew --prefix openssl@1.1)/include" pip install cryptography
$ sudo port install openssl$ env LDFLAGS="-L/opt/local/lib" CFLAGS="-I/opt/local/include" pip install cryptography
You can also build cryptography statically:
$ brew install openssl@1.1$ env CRYPTOGRAPHY_SUPPRESS_LINK_FLAGS=1 LDFLAGS="$(brew --prefix openssl@1.1)/lib/libssl.a $(brew --prefix openssl@1.1)/lib/libcrypto.a" CFLAGS="-I$(brew --prefix openssl@1.1)/include" pip install cryptography
$ sudo port install openssl$ env CRYPTOGRAPHY_SUPPRESS_LINK_FLAGS=1 LDFLAGS="/opt/local/lib/libssl.a /opt/local/lib/libcrypto.a" CFLAGS="-I/opt/local/include" pip install cryptography
If you need to rebuild cryptography
for any reason be sure to clear thelocal wheel cache.