Supported platforms

Currently we testcryptography on Python 3.8+ and PyPy3.11 on theseoperating systems.

• x86-64 CentOS Stream 9, 10

• x86-64 Fedora (latest)

• x86-64 and ARM64 macOS 15 Sequoia

• x86-64 Ubuntu 22.04, 24.04, and rolling

• ARM64, ARMv7l, andppc64le Ubuntu rolling

• x86-64 Debian Bookworm (12.x), Trixie (13.x), and Sid (unstable)

• x86-64 and ARM64 Alpine (latest)

• 32-bit and 64-bit Python on 64-bit Windows Server 2022

• ARM64 Windows 11

We test compiling withclang as well asgcc and use the followingOpenSSL releases in addition to distribution provided releases from theabove supported platforms:

• OpenSSL3.0-latest

• OpenSSL3.2-latest

• OpenSSL3.3-latest

• OpenSSL3.4-latest

• OpenSSL3.5-latest

We also test against the latest commit of BoringSSL, the latestaws-lc release,and versions of LibreSSL that are receiving security support at the time of agivencryptography release.

Building cryptography on Windows

The wheel package on Windows is a statically linked build (as of 0.5) so alldependencies are included. To installcryptography, you will typicallyjust run

$pipinstallcryptography

If you prefer to compile it yourself you’ll need to have OpenSSL installed.You can compile OpenSSL yourself as well or usea binary distribution.Be sure to download the proper version for your architecture and Python(VC2015 is required for 3.8 and above). Wherever you place your copy of OpenSSLyou’ll need to set theOPENSSL_DIR environment variable to include theproper location. For example:

C:\> \path\to\vcvarsall.bat x86_amd64C:\> set OPENSSL_DIR=C:\OpenSSL-win64C:\> pip install cryptography

You will also need to haveRust installed andavailable.

If you need to rebuildcryptography for any reason be sure to clear thelocalwheel cache.

Building cryptography on Linux

cryptography shipsmanylinux wheels (as of 2.0) so all dependenciesare included. For users onpip 19.3 or above running on amanylinux2014(or greater) compatible distribution (orpip 21.2.4 formusllinux) allyou should need to do is:

$pipinstallcryptography

If you want to compilecryptography yourself you’ll need a C compiler, aRust compiler, headers for Python (if you’re not usingpypy), and headersfor the OpenSSL andlibffi libraries available on your system.

On all Linux distributions you will need to haveRust installed andavailable.

$sudoapkaddgccmusl-devpython3-devlibffi-devopenssl-devcargopkgconfig

$sudoapt-getinstallbuild-essentiallibssl-devlibffi-dev\python3-devcargopkg-config

$sudodnfinstallredhat-rpm-configgcclibffi-develpython3-devel\openssl-develcargopkg-config

$pipinstallcryptography--no-binarycryptography

$./config-Wl,-Bsymbolic-functions-fPICshared

set -eOPENSSL_VERSION="VERSIONGOESHERE"CWD=$(pwd)virtualenv env. env/bin/activatepip install -U setuptoolspip install -U wheel pipcurl -O https://www.openssl.org/source/openssl-${OPENSSL_VERSION}.tar.gztar xvf openssl-${OPENSSL_VERSION}.tar.gzcd openssl-${OPENSSL_VERSION}./config no-shared no-ssl2 no-ssl3 -fPIC --prefix=${CWD}/opensslmake && make installcd ..OPENSSL_DIR="${CWD}/openssl" pip wheel --no-cache-dir --no-binary cryptography cryptography

Building cryptography on macOS

The wheel package on macOS is a statically linked build (as of 1.0.1) so forusers with pip 8 or above you only need one step:

$pipinstallcryptography

If you want to build cryptography yourself or are on an older macOS version,cryptography requires the presence of a C compiler, development headers, andthe proper libraries. On macOS much of this is provided by Apple’s Xcodedevelopment tools. To install the Xcode command line tools (on macOS 10.10+)open a terminal window and run:

$xcode-select--install

This will install a compiler (clang) along with (most of) the requireddevelopment headers.

You will also need to haveRust installed andavailable, which can be obtained fromHomebrew,MacPorts, or directly from the Rust website.

Finally you need OpenSSL, which you can obtain fromHomebrew orMacPorts.Cryptography doesnot support the OpenSSL/LibreSSL libraries Apple shipsin its base operating system.

To build cryptography and dynamically link it:

Homebrew

$brewinstallopenssl@3rust$pipinstall--no-binarycryptographycryptography

MacPorts:

$sudoportinstallopensslrust$envOPENSSL_DIR="-L/opt/local"pipinstall--no-binarycryptographycryptography

You can also build cryptography statically:

Homebrew

$brewinstallopenssl@3rust$envOPENSSL_STATIC=1pipinstall--no-binarycryptographycryptography

MacPorts:

$sudoportinstallopensslrust$envOPENSSL_STATIC=1OPENSSL_DIR="/opt/local"pipinstall--no-binarycryptographycryptography

If you need to rebuildcryptography for any reason be sure to clear thelocalwheel cache.

Building with BoringSSL, LibreSSL, or AWS-LC

To build against BoringSSL, LibreSSL, or AWS-LC instead of OpenSSL, you can set theOPENSSL_DIR environment variable to point to your BoringSSL, LibreSSL, or AWS-LCinstallation directory.

Rust

Buildingcryptography requires having a working Rust toolchain. The currentminimum supported Rust version is 1.83.0.This is newer than the Rust somepackage managers ship, so users may need to install with theinstructions below.

Instructions for installing Rust can be found onthe Rust Project’s website.We recommend installing Rust withrustup (as documented by the RustProject) in order to ensure you have a recent version.

Rust is only required when buildingcryptography, meaning that you mayinstall it for the duration of yourpipinstall command and then remove itfrom a system. A Rust toolchain is not required tousecryptography. Indeployments such asdocker, you may use a multi-stageDockerfile whereyou install Rust during the build phase but do not install it in the runtimeimage. This is the same as the C compiler toolchain which is also required tobuildcryptography, but not afterwards.