Skip to main content

OpenSSL on Windows with legacy support

The Windows OpenSSL installer needs a little setup afterward to make OpenSSL available in the server's runtime environment: a system environment variable and a PATH entry pointing at the OpenSSL bin directory (where openssl.exe lives).

There are two common install locations on Windows; if you did not take the defaults, yours may differ:

C:\Program Files\OpenSSL-Win64\bin
C:\OpenSSL-Win64\bin

This article assumes C:\OpenSSL-Win64\bin. Adjust the steps for your install location.

Add a system environment variable​

Open the Windows Environment Variables screen and add this system variable:

  • Variable name: OPENSSL
  • Variable value: C:\OpenSSL-Win64\bin

Add it to the system PATH​

On the same screen, edit the system Path variable and add:

C:\OpenSSL-Win64\bin

Test the change in an elevated PowerShell window:

openssl version

If the system responds with an OpenSSL version, OpenSSL is configured and ready.

Add OpenSSL legacy support​

Since Informer 2025.1.0, new installs of Informer and OpenSSL ship with OpenSSL 3.x, which disables older security algorithms by leaving them out of the base openssl.exe. Extended support remains in the OpenSSL legacy.dll in the OpenSSL bin folder. To enable it, add this system variable:

  • Variable name: OPENSSL_MODULES
  • Variable value: C:\OpenSSL-Win64\bin

Without legacy support, you may see an error like this when an operation needs a legacy algorithm:

Error: Invalid openssl exit code: 1
% openssl pkcs12 -in <SomeFilePath> -passin file:C:\Windows\TEMP\5c6ea96b6e3eda7c01d8b7911868cddbd41372f4 -legacy -traditional -nodes
pkcs12: unable to load provider legacy
Hint: use -provider-path option or OPENSSL_MODULES environment variable.