Installation¶
You can install cryptography
with pip
:
$ pip install cryptography
Supported platforms¶
Currently we test cryptography
on Python 2.6, 2.7, 3.3, 3.4, 3.5, 3.6, and
PyPy 5.3+ on these operating systems.
- x86-64 CentOS 7.x
- x86-64 FreeBSD 11
- macOS 10.12 Sierra, 10.11 El Capitan, 10.10 Yosemite, 10.9 Mavericks
- x86-64 Ubuntu 14.04, 16.04, and rolling
- x86-64 Debian Wheezy (7.x), Jessie (8.x), Stretch (9.x), and Sid (unstable)
- 32-bit and 64-bit Python on 64-bit Windows Server 2012
Warning
Python 2.6 is no longer supported by the Python core team. A future version of cryptography will drop support for this version.
Python 3.3 support will be removed in the next cryptography release.
We test compiling with clang
as well as gcc
and use the following
OpenSSL releases:
OpenSSL 1.0.1
OpenSSL 1.0.1e-fips
(RHEL/CentOS 7
)OpenSSL 1.0.1j-freebsd
OpenSSL 1.0.1f
OpenSSL 1.0.2-latest
OpenSSL 1.1.0-latest
Building cryptography on Windows¶
The wheel package on Windows is a statically linked build (as of 0.5) so all
dependencies are included. To install cryptography
, you will typically
just run
$ pip install cryptography
If you prefer to compile it yourself you’ll need to have OpenSSL installed.
You can compile OpenSSL yourself as well or use the binaries we build for our
release infrastructure (openssl-release). Be sure to download the proper
version for your architecture and Python (2010 works for Python 2.6, 2.7, 3.3,
and 3.4 while 2015 is required for 3.5 and above). Wherever you place your copy
of OpenSSL you’ll need to set the LIB
and INCLUDE
environment variables
to include the proper locations. For example:
C:\> \path\to\vcvarsall.bat x86_amd64
C:\> set LIB=C:\OpenSSL-win64\lib;%LIB%
C:\> set INCLUDE=C:\OpenSSL-win64\include;%INCLUDE%
C:\> pip install cryptography
As of OpenSSL 1.1.0 the library names have changed from libeay32
and
ssleay32
to libcrypto
and libssl
(matching their names on all other
platforms). cryptography
links against the new 1.1.0 names by default. If
you need to compile cryptography
against an older version then you must
set CRYPTOGRAPHY_WINDOWS_LINK_LEGACY_OPENSSL
or else installation will fail.
If you need to rebuild cryptography
for any reason be sure to clear the
local wheel cache.
Building cryptography on Linux¶
cryptography
should build very easily on Linux provided you have a C
compiler, headers for Python (if you’re not using pypy
), and headers for
the OpenSSL and libffi
libraries available on your system.
For Debian and Ubuntu, the following command will ensure that the required
dependencies are installed (replace python-dev
with python3-dev
if
you’re using Python 3):
$ sudo apt-get install build-essential libssl-dev libffi-dev python-dev
For Fedora and RHEL-derivatives, the following command will ensure that the
required dependencies are installed (replace python-devel
with
python3-devel
if you’re using Python 3):
$ sudo yum install gcc libffi-devel python-devel openssl-devel
You should now be able to build and install cryptography with the usual
$ pip install cryptography
Using your own OpenSSL on Linux¶
Python links to OpenSSL for its own purposes and this can sometimes cause problems when you wish to use a different version of OpenSSL with cryptography. If you want to use cryptography with your own build of OpenSSL you will need to make sure that the build is configured correctly so that your version of OpenSSL doesn’t conflict with Python’s.
The options you need to add allow the linker to identify every symbol correctly even when multiple versions of the library are linked into the same program. If you are using your distribution’s source packages these will probably be patched in for you already, otherwise you’ll need to use options something like this when configuring OpenSSL:
$ ./config -Wl,--version-script=openssl.ld -Wl,-Bsymbolic-functions -fPIC shared
You’ll also need to generate your own openssl.ld
file. For example:
OPENSSL_1.1.0E_CUSTOM {
global:
*;
};
You should replace the version string on the first line as appropriate for your build.
Static Wheels¶
Cryptography ships statically-linked wheels for macOS and Windows, ensuring that these platforms can always use the most-recent OpenSSL, regardless of what is shipped by default on those platforms. As a result of various difficulties around Linux binary linking, Cryptography cannot do the same on Linux.
However, you can build your own statically-linked wheels that will work on your own systems. This will allow you to continue to use relatively old Linux distributions (such as LTS releases), while making sure you have the most recent OpenSSL available to your Python programs.
To do so, you should find yourself a machine that is as similar as possible to your target environment (e.g. your production environment): for example, spin up a new cloud server running your target Linux distribution. On this machine, install the Cryptography dependencies as mentioned in Building cryptography on Linux. Please also make sure you have virtualenv installed: this should be available from your system package manager.
Then, paste the following into a shell script. You’ll need to populate the
OPENSSL_VERSION
variable. To do that, visit openssl.org and find the
latest non-FIPS release version number, then set the string appropriately. For
example, for OpenSSL 1.0.2k, use OPENSSL_VERSION="1.0.2k"
.
When this shell script is complete, you’ll find a collection of wheel files in
a directory called wheelhouse
. These wheels can be installed by a
sufficiently-recent version of pip
. The Cryptography wheel in this
directory contains a statically-linked OpenSSL binding, which ensures that you
have access to the most-recent OpenSSL releases without corrupting your system
dependencies.
set -e
OPENSSL_VERSION="VERSIONGOESHERE"
CWD=$(pwd)
virtualenv env
. env/bin/activate
pip install -U setuptools
pip install -U wheel pip
curl -O https://www.openssl.org/source/openssl-${OPENSSL_VERSION}.tar.gz
tar xvf openssl-${OPENSSL_VERSION}.tar.gz
cd openssl-${OPENSSL_VERSION}
./config no-shared no-ssl2 no-ssl3 -fPIC --prefix=${CWD}/openssl
make && make install
cd ..
CFLAGS="-I${CWD}/openssl/include" LDFLAGS="-L${CWD}/openssl/lib" pip wheel --no-use-wheel cryptography
Building cryptography on macOS¶
Note
If installation gives a fatal error: 'openssl/aes.h' file not found
see the FAQ for information about how to fix this issue.
The wheel package on macOS is a statically linked build (as of 1.0.1) so for users with pip 8 or above you only need one step:
$ pip install cryptography
If you want to build cryptography yourself or are on an older macOS version, cryptography requires the presence of a C compiler, development headers, and the proper libraries. On macOS much of this is provided by Apple’s Xcode development tools. To install the Xcode command line tools (on macOS 10.9+) open a terminal window and run:
$ xcode-select --install
This will install a compiler (clang) along with (most of) the required development headers.
You’ll also need OpenSSL, which you can obtain from Homebrew or MacPorts. Cryptography does not support Apple’s deprecated OpenSSL distribution.
To build cryptography and dynamically link it:
$ brew install openssl@1.1
$ env LDFLAGS="-L$(brew --prefix openssl@1.1)/lib" CFLAGS="-I$(brew --prefix openssl@1.1)/include" pip install cryptography
$ sudo port install openssl
$ env LDFLAGS="-L/opt/local/lib" CFLAGS="-I/opt/local/include" pip install cryptography
You can also build cryptography statically:
$ brew install openssl@1.1
$ env CRYPTOGRAPHY_SUPPRESS_LINK_FLAGS=1 LDFLAGS="$(brew --prefix openssl@1.1)/lib/libssl.a $(brew --prefix openssl@1.1)/lib/libcrypto.a" CFLAGS="-I$(brew --prefix openssl@1.1)/include" pip install cryptography
$ sudo port install openssl
$ env CRYPTOGRAPHY_SUPPRESS_LINK_FLAGS=1 LDFLAGS="/opt/local/lib/libssl.a /opt/local/lib/libcrypto.a" CFLAGS="-I/opt/local/include" pip install cryptography
If you need to rebuild cryptography
for any reason be sure to clear the
local wheel cache.
Building cryptography with conda¶
Because of a bug in conda, attempting to install cryptography out of the box will result in an error. This can be resolved by setting the library path environment variable for your platform.
On macOS:
$ env DYLD_LIBRARY_PATH="$HOME/anaconda/lib" pip install cryptography
and on Linux:
$ env LD_LIBRARY_PATH="$HOME/anaconda/lib" pip install cryptography
You will need to set this variable every time you start Python. For more information, consult Greg Wilson’s blog post on the subject.