OpenSSL for Android (Windows) - Prebuilt + Buildscript

This repository contains:

• A Windows-only PowerShell script to build OpenSSL for Android (static and/or shared .so) using the Android NDK and MSYS2: build_openssl_android_rsp.ps1
• Prebuilt outputs for each ABI (see install/)
  • Prebuilt (arm64-v8a)
  • Prebuilt (armeabi-v7a)
  • Prebuilt (x86_64)

Available install variants (per BuildType × strip state):

• install/RelWithDebInfo-unstripped/<abi>/...
• install/RelWithDebInfo-stripped/<abi>/...
• install/Release-unstripped/<abi>/...
• install/Release-stripped/<abi>/...
• install/Debug-unstripped/<abi>/...
• install/Debug-stripped/<abi>/...

What it does

• Downloads the specified OpenSSL source release (default: 3.6.0)
• Builds OpenSSL for one or more Android ABIs (default: arm64-v8a, armeabi-v7a, x86_64)
• Installs the outputs into ABI-specific folders, including:
  • libcrypto.so, libssl.so (if shared build enabled)
  • libcrypto.a, libssl.a
  • headers under include/

Output location (relative to the script folder):

• openssl\install\<BuildType>-<stripped|unstripped>\<ABI>\

Example:

• openssl\install\RelWithDebInfo-unstripped\arm64-v8a\lib\libcrypto.so

Prerequisites (Windows)

1) MSYS2

Install MSYS2 and ensure the MSYS2 usr\bin tools are available.

choco install msys2

The script defaults to:

• C:\tools\msys64\usr\bin

If your MSYS2 is installed elsewhere, you must pass -Msys2Bin (see Usage).

Required MSYS2 packages:

• make
• perl
• base-devel (recommended)
• git (recommended)

Install/update in an MSYS2 shell:

pacman -Syu
# restart MSYS2 if it asks you to, then:
pacman -S --needed base-devel make perl git

1.5) Perl

In case you run into any errors or problems when using perl installed by msys2, you can fallback to strawberryperl. The script was tested on perl installed by msys2 aswell as strawberryperl. Imo strawberryperl has better compatibility with windows compared to perl by msys2.

choco install strawberryperl

2) Android SDK + NDK

You need an installed Android NDK (r25+ recommended; r28 works fine).

Typical path:

• C:\Users\<YOU>\AppData\Local\Android\Sdk\ndk\<VERSION>

The NDK must contain:

• toolchains\llvm\prebuilt\windows-x86_64\bin\

3) Windows built-in tar

The script uses:

• %WINDIR%\System32\tar.exe

(Windows 10/11 should already have it.)

4) PowerShell

Works with Windows PowerShell 5.1 and PowerShell 7+.

Required Environment Variables

ANDROID_NDK_HOME (required unless you pass -NDK)

Set this to your NDK root folder.

PowerShell (current session):

$env:ANDROID_NDK_HOME = "C:\Users\<User>\AppData\Local\Android\Sdk\ndk\28.2.13676358"

Permanent (User env var):

setx ANDROID_NDK_HOME "C:\Users\<User>\AppData\Local\Android\Sdk\ndk\28.2.13676358"

If ANDROID_NDK_HOME is not set, the script will fail unless you provide -NDK.

No other environment variables are strictly required by the script.

Usage

Open a PowerShell in the folder where the script is located.

Build with defaults

.\build_openssl_android_rsp.ps1

Defaults:

• OpenSSL: 3.6.0
• API level: 21
• ABIs: arm64-v8a, armeabi-v7a, x86_64
• Shared build: enabled (.so will be produced)
• MSYS2 bin: C:\tools\msys64\usr\bin

Specify the NDK path explicitly

.\build_openssl_android_rsp.ps1 -NDK "C:\Users\<User>\AppData\Local\Android\Sdk\ndk\28.2.13676358"

Use a different MSYS2 installation path

.\build_openssl_android_rsp.ps1 -Msys2Bin "C:\msys64\usr\bin"

Build only one ABI

.\build_openssl_android_rsp.ps1 -ABIs @("arm64-v8a")

Build type and strip controls

You can control the compiler flags (debug vs release) and whether the produced .so are stripped of debug symbols:

# Build RelWithDebInfo (optimized but contains debug symbols), unstripped
.\build_openssl_android_rsp.ps1 -ABIs @('arm64-v8a') -BuildType RelWithDebInfo -Strip:$false

# Build RelWithDebInfo and strip binaries (for runtime/distribution)
.\build_openssl_android_rsp.ps1 -ABIs @('arm64-v8a') -BuildType RelWithDebInfo -Strip:$true

# Build Debug (no optimization, maximal debug info)
.\build_openssl_android_rsp.ps1 -ABIs @('arm64-v8a') -BuildType Debug -Strip:$false

Only strip existing unstripped installs

If you already have an unstripped install (for example from a previous run that produced RelWithDebInfo-unstripped), you can run the script in "strip-only" mode which copies the unstripped install tree to a -stripped variant and runs the NDK llvm-strip on the .so and binaries.

Requirements:

• The source folder must exist: openssl\install\<BuildType>-unstripped\.
• ANDROID_NDK_HOME or -NDK must point to an NDK with toolchains\llvm\prebuilt\<host>.

Example (copy unstripped Release -> stripped and strip):

.\build_openssl_android_rsp.ps1 -BuildType Release -OnlyStrip:$true -NDK 'C:\path\to\android-ndk'

After completion the stripped outputs are available under: openssl\install\<BuildType>-stripped\<ABI>\...

Change Android API level

.\build_openssl_android_rsp.ps1 -ApiLevel 24

Build static only (no .so)

.\build_openssl_android_rsp.ps1 -BuildShared:$false

Build a different OpenSSL version

.\build_openssl_android_rsp.ps1 -OpenSSLVer "3.5.2"

Where to find the results

After a successful build, files are installed under a build-type specific layout:

• openssl\install\<BuildType>-<stripped|unstripped>\<ABI>\

Examples:

• Unstripped RelWithDebInfo for arm64: openssl\install\RelWithDebInfo-unstripped\arm64-v8a\lib\libcrypto.so
• Stripped Release for x86_64: openssl\install\Release-stripped\x86_64\lib\libcrypto.so

Important folders:

Important folders in the per-build install tree:

• openssl\install\<BuildType>-<stripped|unstripped>\<ABI>\include\ (headers)

• openssl\install\<BuildType>-<stripped|unstripped>\<ABI>\lib\

  • libcrypto.so, libssl.so (if -BuildShared:$true)
  • libcrypto.a, libssl.a

Build logs per ABI:

• openssl\build-openssl\android-<ABI>\build.log

Notes / Troubleshooting

“DEBUG: all keys…” / “No value given for …”

These messages can appear during OpenSSL’s configdata steps and are often harmless if the build continues and completes.

“Argument list too long”

This happens on Windows when the linker command line gets huge. This script version uses a response-file approach (.rsp) to avoid that. If you still see it, double-check that you are running this script (build_openssl_android_rsp.ps1) and not an older variant. Alternatively you can decrease the treshold in the script in line 343:

if [ "$len" -gt 700 ]; then # change 700 to whatever treshold you need

Paths with spaces

Try to keep the NDK and your project folder paths short and without special characters/spaces if you run into weird build issues.

Quick checklist

• MSYS2 installed and contains perl + make
• ANDROID_NDK_HOME points to a valid NDK root
• Script runs from PowerShell without policy issues (use -ExecutionPolicy Bypass if needed)
• .so files appear under openssl\install\<ABI>\lib\

Example with execution policy bypass:

powershell -ExecutionPolicy Bypass -File .\build_openssl_android_rsp.ps1