SSL Static linking for QT 5.15.2 with MingGW

[Petr Gaube]

Hi, I'm having a problem with SSL support for my small application. For a while I was using the static build of Qt version 4.7.0. Now I decide to upgrade to 5.15.2 with static build and now with support for SSL.

After some try&error I have a stable static build with SSL support. Application is working fine but just on my machine!
When I try to run my app on other laptop without any developemnt tools (just a pure Windows 10) I got an error:
"OpenSSL support status: fail" with following network error 99: TLS initialization failed

I also tried to provide my EXE file together with SSL libs but the result is the same.
My idea is to just provide one standalone EXE file of my application. The reason is that it is a very small app just reporting some data from server.

My setup is:
Qt 5.15.2 static build with following configuration:

git clone --recursive https://github.com/qt/qt5.git --branch 5.15.2

SET QT_HOME=C:\Qt\git\qt5
SET MINGW_HOME=C:\Qt\Tools\mingw810_32
SET OPENSSL_HOME=C:\Qt\OpenSSL-Win32
SET PATH=%QT_HOME%\qtbase\bin;%PATH% 
SET PATH=%QT_HOME%\qtrepotools\bin;%PATH%
SET PATH=%MINGW_HOME%\bin;%PATH%
SET PATH=%MINGW_HOME%\include;%PATH%
SET PATH=%MINGW_HOME%\lib;%PATH%
SET PATH=%OPENSSL_HOME%\bin;%PATH%
SET PATH=%OPENSSL_HOME%\include;%PATH%
SET PATH=%OPENSSL_HOME%\include\openssl;%PATH%
SET PATH=%OPENSSL_HOME%\lib;%PATH%
SET OPENSSL_LIBS=-LC:\Qt\OpenSSL-Win32\lib -IC:\Qt\OpenSSL-Win32\include\openssl -IC:\Qt\OpenSSL-Win32\include -llibssl -llibcrypto

configure -recheck -release -static -opengl desktop -platform win32-g++ -c++std c++11 -ssl -openssl -I%OPENSSL_HOME%\include\openssl -I%OPENSSL_HOME%\include -I%MINGW_HOME%\include -L%OPENSSL_HOME%\lib -L%MINGW_HOME%\lib -prefix "C:\Qt\5.15.2_static" -skip webengine -nomake tools -nomake tests -nomake examples -skip qtconnectivity

I installed the Windows version of OpenSSL in version 1.1.1k from link: https://slproweb.com/products/Win32OpenSSL.html

My build setup is:

QT       += core gui network

greaterThan(QT_MAJOR_VERSION, 4): QT += widgets

CONFIG += c++11 static console
QMAKE_LFLAGS = -static -static-libgcc

# You can make your code fail to compile if it uses deprecated APIs.
# In order to do so, uncomment the following line.
#DEFINES += QT_DISABLE_DEPRECATED_BEFORE=0x060000    # disables all the APIs deprecated before Qt 6.0.0

SOURCES += \
    main.cpp \
    contic.cpp \
    src/analogclock.cpp

RC_FILE = contic.rc

TARGET =  MyPlanningGadget


HEADERS += \
    contic.h \
    src/analogclock.h

FORMS += \
    contic.ui

INCLUDEPATH += \
    src

# Default rules for deployment.
qnx: target.path = /tmp/$${TARGET}/bin
else: unix:!android: target.path = /opt/$${TARGET}/bin
!isEmpty(target.path): INSTALLS += target

CODECFORTR = ISO-8859-2
CODECFORSRC = ISO-8859-2

DISTFILES +=

RESOURCES += \
  resources.qrc

I do not need to even define the includes and libs for SSL in my build setup because (probably thanks to Qt static build) it is already automatically included in the build process when Qt Creator is building my app:

g++ -static -static-libgcc -Wl,-s -Wl,-subsystem,console -Wl,--gc-sections -mthreads -o release\MyPlanningGadget.exe release/main.o release/contic.o release/analogclock.o release/myplanninggadget_plugin_import.o release/qrc_resources.o release/moc_contic.o release/moc_analogclock.o  C:\Qt\5.15.2_static\plugins\styles\libqwindowsvistastyle.a -LC:\Qt\OpenSSL-Win32\lib -LC:\Qt\Tools\mingw810_32\lib C:\Qt\5.15.2_static\plugins\platforms\libqwindows.a -lwinspool -lshlwapi -lwtsapi32 C:\Qt\5.15.2_static\lib\libQt5EventDispatcherSupport.a C:\Qt\5.15.2_static\lib\libQt5FontDatabaseSupport.a C:\Qt\5.15.2_static\lib\libqtfreetype.a -ldwrite -ld2d1 C:\Qt\5.15.2_static\lib\libQt5ThemeSupport.a C:\Qt\5.15.2_static\lib\libQt5AccessibilitySupport.a C:\Qt\5.15.2_static\lib\libQt5WindowsUIAutomationSupport.a C:\Qt\5.15.2_static\plugins\imageformats\libqgif.a C:\Qt\5.15.2_static\plugins\imageformats\libqicns.a C:\Qt\5.15.2_static\plugins\imageformats\libqico.a C:\Qt\5.15.2_static\plugins\imageformats\libqjpeg.a C:\Qt\5.15.2_static\plugins\imageformats\libqtga.a C:\Qt\5.15.2_static\plugins\imageformats\libqtiff.a C:\Qt\5.15.2_static\plugins\imageformats\libqwbmp.a C:\Qt\5.15.2_static\plugins\imageformats\libqwebp.a C:\Qt\5.15.2_static\plugins\bearer\libqgenericbearer.a C:\Qt\5.15.2_static\lib\libQt5Widgets.a -luxtheme -ldwmapi C:\Qt\5.15.2_static\lib\libQt5Gui.a -ld3d11 -ldxgi -ldxguid C:\Qt\5.15.2_static\lib\libqtlibpng.a C:\Qt\5.15.2_static\lib\libqtharfbuzz.a -lcomdlg32 -loleaut32 -limm32 -lglu32 -lopengl32 -lgdi32 C:\Qt\5.15.2_static\lib\libQt5Network.a -ldnsapi -liphlpapi -lcrypt32 C:\Qt\5.15.2_static\lib\libQt5Core.a -lmpr -luserenv -lversion -lz C:\Qt\5.15.2_static\lib\libqtpcre2.a -lnetapi32 -lws2_32 -ladvapi32 -lkernel32 -lole32 -lshell32 -luuid -luser32 -lwinmm release\contic_res.o  -lglu32 -lopengl32 -lgdi32 -luser32 
mingw32-make[1]: Leaving directory 'D:/Projects/Qt_projects/Qt_Contic_3/contic3'

Anyway I also tried to add the SSL libraries manualy but no help again:

LIBS += -llibssl -llibcrypto

or

LIBS += D:\Projects\Qt_projects\Qt_Contic_3\contic3\lib\libcrypto.dll.a
LIBS += D:\Projects\Qt_projects\Qt_Contic_3\contic3\lib\libssl.dll.a

Running fully fine on my laptop but the same error occurred while trying to delivered to another laptop.

[SGaist]

Hi and welcome to devnet,

From the looks of it, you did not pass the "-openssl-linked" parameter to configure. Therefore it's still using the standard dlopen technique.

[Petr Gaube]

I also tried to build the Qt with -openssl-linked but then the application fail to run because of missing openSSL libs.
It is always a problem to run it on customer pure Windows 10 laptop:
-openssl: Application runable but SSL not supported, Network error 99
-openssl-linked: Application not runable, runtime fail, missing ssl and cpryto DDL files.

I found the same issue here: https://www.py4u.net/discuss/119103
Basically I have exactly the same problem.

It just looks to me that no matter I do the Qt build is not done with static version of OpenSSL libraries.

[SGaist]

You also need a fully static build of OpenSSL.

If you have both shared and static libraries in the same folder, just move the shared one in a different folder.

[Petr Gaube]

How I can be sure I have it? I install the OpenSSL package and I got these libraries:

C:\Qt\OpenSSL-Win32\lib\capi.lib
C:\Qt\OpenSSL-Win32\lib\dasync.lib
C:\Qt\OpenSSL-Win32\lib\libapps.lib
C:\Qt\OpenSSL-Win32\lib\libcrypto.def
C:\Qt\OpenSSL-Win32\lib\libcrypto.lib
C:\Qt\OpenSSL-Win32\lib\libcrypto_static.lib
C:\Qt\OpenSSL-Win32\lib\libssl.def
C:\Qt\OpenSSL-Win32\lib\libssl.lib
C:\Qt\OpenSSL-Win32\lib\libssl_static.lib
C:\Qt\OpenSSL-Win32\lib\libtestutil.lib
C:\Qt\OpenSSL-Win32\lib\MinGW
C:\Qt\OpenSSL-Win32\lib\openssl.lib
C:\Qt\OpenSSL-Win32\lib\ossltest.lib
C:\Qt\OpenSSL-Win32\lib\padlock.lib
C:\Qt\OpenSSL-Win32\lib\uitest.lib
C:\Qt\OpenSSL-Win32\lib\VC
C:\Qt\OpenSSL-Win32\lib\MinGW\libcrypto.def
C:\Qt\OpenSSL-Win32\lib\MinGW\libcrypto.dll.a
C:\Qt\OpenSSL-Win32\lib\MinGW\libssl.def
C:\Qt\OpenSSL-Win32\lib\MinGW\libssl.dll.a
C:\Qt\OpenSSL-Win32\lib\VC\libcrypto32MD.lib
C:\Qt\OpenSSL-Win32\lib\VC\libcrypto32MDd.lib
C:\Qt\OpenSSL-Win32\lib\VC\libcrypto32MT.lib
C:\Qt\OpenSSL-Win32\lib\VC\libcrypto32MTd.lib
C:\Qt\OpenSSL-Win32\lib\VC\libssl32MD.lib
C:\Qt\OpenSSL-Win32\lib\VC\libssl32MDd.lib
C:\Qt\OpenSSL-Win32\lib\VC\libssl32MT.lib
C:\Qt\OpenSSL-Win32\lib\VC\libssl32MTd.lib
C:\Qt\OpenSSL-Win32\lib\VC\static
C:\Qt\OpenSSL-Win32\lib\VC\static\libcrypto32MD.lib
C:\Qt\OpenSSL-Win32\lib\VC\static\libcrypto32MDd.lib
C:\Qt\OpenSSL-Win32\lib\VC\static\libcrypto32MT.lib
C:\Qt\OpenSSL-Win32\lib\VC\static\libcrypto32MTd.lib
C:\Qt\OpenSSL-Win32\lib\VC\static\libssl32MD.lib
C:\Qt\OpenSSL-Win32\lib\VC\static\libssl32MDd.lib
C:\Qt\OpenSSL-Win32\lib\VC\static\libssl32MT.lib
C:\Qt\OpenSSL-Win32\lib\VC\static\libssl32MTd.lib

So I would suggest to use libraries from lib\MinGW. So I tried to update my configuration for Qt build to:

... 
SET OPENSSL_LIBS=-LC:\Qt\OpenSSL-Win32\lib\MinGW -IC:\Qt\OpenSSL-Win32\include\openssl -IC:\Qt\OpenSSL-Win32\include -llibssl -llibcrypto

configure -recheck -release -static -opengl desktop -platform win32-g++ -c++std c++11 -ssl -openssl-linked -I%OPENSSL_HOME%\include\openssl -I%OPENSSL_HOME%\include -I%MINGW_HOME%\include -L%OPENSSL_HOME%\lib\MinGW -L%MINGW_HOME%\lib -prefix "C:\Qt\5.15.2_static" -skip webengine -nomake tools -nomake tests -nomake examples -skip qtconnectivity

Configuration and build is ok but ... I can build the application, I can see that proper libraries are used:
From build log:

C:\Qt\OpenSSL-Win32\lib\MinGW\libssl.dll.a C:\Qt\OpenSSL-Win32\lib\MinGW\libcrypto.dll.a

.... but the application crash even on my development laptop: missing ssl and crypto DDLs.

I'm so lost.

[Petr Gaube]

So after some other tries I find out that the best configuration for me with -openssl (not linked). To be honest I'm not sure if linked means static. When searching on Google I found some hints that it is static but also some hints it is not static.

For example even here on this forum in this thread:
https://forum.qt.io/topic/15227/statically-linking-the-openssl-libraries/6

So my final configuration is:

SET QT_HOME=C:\Qt\git\qt5
SET MINGW_HOME=C:\Qt\Tools\mingw810_32
SET OPENSSL_HOME=C:\Qt\OpenSSL-Win32
SET PATH=%QT_HOME%\qtbase\bin;%PATH% 
SET PATH=%QT_HOME%\qtrepotools\bin;%PATH%
SET PATH=%MINGW_HOME%\bin;%PATH%
SET PATH=%MINGW_HOME%\include;%PATH%
SET PATH=%MINGW_HOME%\lib;%PATH%
SET PATH=%OPENSSL_HOME%\bin;%PATH%
SET PATH=%OPENSSL_HOME%\include;%PATH%
SET PATH=%OPENSSL_HOME%\include\openssl;%PATH%
SET PATH=%OPENSSL_HOME%\lib;%PATH%
SET OPENSSL_LIBS=-LC:\Qt\OpenSSL-Win32\lib\MinGW -IC:\Qt\OpenSSL-Win32\include\openssl -IC:\Qt\OpenSSL-Win32\include -llibssl -llibcrypto

configure -recheck -release -static -opengl desktop -platform win32-g++ -c++std c++11 -ssl -openssl -I%OPENSSL_HOME%\include\openssl -I%OPENSSL_HOME%\include -I%MINGW_HOME%\include -L%OPENSSL_HOME%\lib\MinGW -L%MINGW_HOME%\lib -prefix "C:\Qt\5.15.2_static" -skip webengine -nomake tools -nomake tests -nomake examples -skip qtconnectivity

... where OPENSLL_LIBS points directly to MinGW folder. With this configuration I'm able to have 'stable' application. The application is running on customer laptop without the OpenSSL (no crash, no runtime error, no DLL required while starting the app).
BUT the connection to https will fail with error 99 (because of missing OpenSLL). No idea why.

I'm confused because when building the Qt the path points directly to MinGW OpenSLL libraries. To libsll.dll.a and libcrypto.dll.a which are the static libraries right?

Just guessing but ... The libcrypto_static.lib has over 33MB but I can not use it because probably it is intended for VC compilers. When I tried to force Qt to use it the build process failed with many undefined symbols. And on the other side the libcrypto.dll.a in MinGW folder has ONLY the 3MB?! So my assumption would be that static libraries in MinGW folder are not supporting full stack of OpenSLL? So to have really full OpenSSL support I would need to build OpenSSL with MinGW by my own?

Because this would make sence ... I have static linked OpenSSL with static linked Qt. My app is running without any runtime error on customer laptop but just MinGW static version of OpenSSL is not supporting all features so that is why the connection failed with error 99. ?

[Bonnie]

Small tip: A file named "xxx.dll.a" would never be a static library. The name implies that it needs a dll file for runtime.