How to Download and Install OpenSSL

Use an operating-system package when possible

The OpenSSL project publishes source code, not an official general-purpose Windows installer. It recommends checking whether your operating system supplies a prebuilt package before building from source. Use your operating system's package manager or a binary source listed by the OpenSSL project. Avoid unverified download sites.

You need the openssl command-line program for the DKIM guide. You do not need to replace the cryptographic libraries used internally by your operating system or applications.

Check whether OpenSSL is already installed

openssl version -a

If this prints version and build information, continue to the DKIM guide. If the command is not found, use the instructions for your operating system below.

Windows: use Windows Subsystem for Linux

WSL provides a maintained Linux package and avoids choosing an unofficial native Windows build. In an Administrator PowerShell window, install WSL if it is not already available:

wsl --install

Restart Windows if prompted. Open the installed Ubuntu terminal, then update package metadata and install OpenSSL:

sudo apt update
sudo apt install openssl
openssl version -a

Run the DKIM key-generation commands inside the same WSL terminal. Windows drives appear below /mnt, but generate and protect the private key in your Linux home directory unless you have a documented secure-storage location.

If WSL is not suitable, review the third-party binary providers listed by the OpenSSL project. Confirm publisher identity, download over HTTPS, verify any published checksum or signature, and follow your organization's software-installation policy. The OpenSSL project does not endorse those third-party packages.

macOS: install with Homebrew

macOS includes system cryptographic components, but the openssl command may be absent or may not be the OpenSSL release expected by the DKIM commands. If Homebrew is already installed, install its supported OpenSSL formula:

brew update
brew install openssl@3
$(brew --prefix openssl@3)/bin/openssl version -a

Homebrew keeps versioned OpenSSL formulae separate from system software. Use the full path shown above if openssl still resolves to another program. If Homebrew is not installed, follow the installation instructions at brew.sh before running these commands.

Ubuntu, Debian, and related Linux distributions

sudo apt update
sudo apt install openssl
openssl version -a

Use the distribution package rather than downloading a standalone .deb from an arbitrary mirror. The package manager selects the correct architecture and receives distribution security updates.

Fedora, RHEL, Rocky Linux, and AlmaLinux

sudo dnf install openssl
openssl version -a

On older systems that still use YUM, substitute yum for dnf. Use the repositories approved for that system.

Arch Linux

sudo pacman -Syu openssl
openssl version -a

This performs a full supported system upgrade before installing OpenSSL, which avoids an unsupported partial upgrade.

Building from source is the advanced path

Build from source only when a package manager cannot meet a documented requirement. Download a supported release from the official OpenSSL source page, verify its published checksum or signature, and follow the included INSTALL.md and platform-specific NOTES files. Do not overwrite the operating system's OpenSSL installation.

For generating a DKIM key pair, a maintained package from the operating system is normally simpler and safer than a custom source build.

Installation checklist

The package came from the operating system, Homebrew, OpenSSL source page, or a provider listed by OpenSSL.
openssl version -a runs successfully in the terminal you will use.
The installed release is still supported by its distributor.
OpenSSL was not downloaded from an unverified software mirror.
You know where DKIM private-key files will be generated and protected.

Continue with DKIM

Once openssl version -a succeeds, return to How to Configure DKIM to generate the key pair, publish the selector record, and verify a signed message.