# OpenSSL for the Windows build (32-bit)

HC Launcher's HTTPS (`fphttpclient` + `opensslsockets`) loads OpenSSL at run
time. The DLLs are **not** in SVN; this folder is where they live on a build
machine, and they must ship beside `Launcher.exe`.

| File | Version | Source |
|---|---|---|
| `libssl-3.dll` | 3.5.8 | FireDaemon OpenSSL 3.5.8 zip, `x86/bin/` |
| `libcrypto-3.dll` | 3.5.8 | same |

## Refill

1. Download `https://download.firedaemon.com/FireDaemon-OpenSSL/openssl-3.5.8.zip`
   (info: https://kb.firedaemon.com/support/solutions/articles/4000121705).
2. Check its SHA-256 against FireDaemon's published value:
   `a5377866b476c1661f329d3f25fc35912fa5ef01e614043b9b9a27baf8dd76a4`.
3. Copy `x86/bin/libssl-3.dll` and `x86/bin/libcrypto-3.dll` here, and beside
   `Launcher.exe` (the build output in the project root) to run it.
4. Both should report file version 3.5.8 and a valid Authenticode signature
   from FireDaemon Technologies Limited.

## Why these

House decision (Lazarus-FPC notes, `fpc-openssl-3.md`, 2026-09-26): never ship
OpenSSL 1.1, end-of-life since 2023-09; use FireDaemon's signed OpenSSL **3.5
LTS** (supported to 2030-04-08) zip, which needs only the Windows UCRT. Stay on
3.5.x: OpenSSL 4.x renames the DLLs, and 3.4/3.6 are short-lived. To update,
replace both files with a newer 3.5.x and change the table above.

FPC 3.2.2 only knows the 1.1 library names, so `uHCLOpenSSL.pas` sets
`DLLSSLName`/`DLLUtilName` to these names (the `-x64` names on a 64-bit build)
before any HTTPS call. On Linux, the shared `uCICOpenSSL3` makes the system's
`libssl.so.3` found instead; nothing here is used there.