diff --git a/CMakeLists.txt b/CMakeLists.txt
index eba5dad..a3a00e8 100755
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -21,21 +21,32 @@ elseif(NOT CMAKE_BUILD_TYPE)
 endif()
 message(STATUS "Build mode: ${CMAKE_BUILD_TYPE}")
 
-# https://cmake.org/cmake/help/v3.6/module/FindOpenSSL.html
-if(NOT "$ENV{OPENSSL_DIR}" STREQUAL "")
-  set(OPENSSL_ROOT_DIR $ENV{OPENSSL_DIR})
-  set(OPENSSL_INCLUDE_DIR "$ENV{OPENSSL_DIR}/include")
-  set(OPENSSL_LIB $ENV{OPENSSL_DIR})
+set(OPENSSL_COMPONENTS REQUIRED COMPONENTS Crypto SSL) # TODO SSL should not be needed if SECUTILS_NO_TLS
+# improved from https://cmake.org/cmake/help/v3.6/module/FindOpenSSL.html
+if(NOT DEFINED OPENSSL_ROOT_DIR AND NOT "$ENV{OPENSSL_DIR}" STREQUAL "")
+  get_filename_component(OPENSSL_ROOT_DIR "$ENV{OPENSSL_DIR}" ABSOLUTE)
+  set(OPENSSL_INCLUDE_DIR "${OPENSSL_ROOT_DIR}/include")
 endif()
-if(DEFINED ENV{OPENSSL_LIB})
-  set(OPENSSL_LIB $ENV{OPENSSL_LIB})
+if(NOT DEFINED OPENSSL_FOUND) # not already done by superordinate module
+  if(DEFINED OPENSSL_ROOT_DIR)
+    find_package(OpenSSL HINTS "${OPENSSL_ROOT_DIR}" NO_DEFAULT_PATH ${OPENSSL_COMPONENTS})
+  else()
+    find_package(OpenSSL ${OPENSSL_COMPONENTS})
+  endif()
+  STRING(REGEX REPLACE "/?/libcrypto\..*" "" OPENSSL_LIB "${OPENSSL_CRYPTO_LIBRARY}")
 endif()
-find_package(OpenSSL QUIET REQUIRED COMPONENTS SSL Crypto)
-if("$ENV{OPENSSL_DIR}" STREQUAL "" OR NOT DEFINED ENV{OPENSSL_LIB})
-  message(STATUS "using OpenSSL package, with version ${OPENSSL_VERSION}")
+message(STATUS "using OpenSSL version ${OPENSSL_VERSION}")
+message(STATUS "using OpenSSL inc dir ${OPENSSL_INCLUDE_DIR}")
+STRING(REGEX REPLACE ";.*" "" OPENSSL_INCLUDE_DIR "${OPENSSL_INCLUDE_DIR}")
+if(NOT EXISTS "${OPENSSL_INCLUDE_DIR}/openssl")
+  message(FATAL_ERROR "OpenSSL include directory does not exist: ${OPENSSL_INCLUDE_DIR}/openssl")
 endif()
-message(STATUS "using OpenSSL hdrs from ${OPENSSL_INCLUDE_DIR}")
-if(NOT "${OPENSSL_LIB}" STREQUAL "")
+if(NOT DEFINED OPENSSL_LIB_SET AND NOT "$ENV{OPENSSL_LIB}" STREQUAL "")
+  set(OPENSSL_LIB_SET 1)
+  get_filename_component(OPENSSL_LIB "$ENV{OPENSSL_LIB}" ABSOLUTE)
+  if(NOT EXISTS "${OPENSSL_LIB}")
+    message(FATAL_ERROR "directory OPENSSL_LIB does not exist: ${OPENSSL_LIB}")
+  endif()
   if(TARGET OpenSSL::Crypto)
     set(OPENSSL_CRYPTO_LIBRARY "${OPENSSL_LIB}/libcrypto${CMAKE_SHARED_LIBRARY_SUFFIX}")
     set_target_properties(OpenSSL::Crypto PROPERTIES IMPORTED_LOCATION ${OPENSSL_CRYPTO_LIBRARY})
@@ -44,8 +55,29 @@ if(NOT "${OPENSSL_LIB}" STREQUAL "")
     set(OPENSSL_SSL_LIBRARY "${OPENSSL_LIB}/libssl${CMAKE_SHARED_LIBRARY_SUFFIX}")
     set_target_properties(OpenSSL::SSL PROPERTIES IMPORTED_LOCATION ${OPENSSL_SSL_LIBRARY})
   endif()
+  # set(OPENSSL_LIBRARIES ${OPENSSL_CRYPTO_LIBRARY} ${OPENSSL_SSL_LIBRARY})
+endif()
+message(STATUS "using OpenSSL lib dir ${OPENSSL_LIB}")
+message(STATUS "using OpenSSL library ${OPENSSL_CRYPTO_LIBRARY}, ${OPENSSL_SSL_LIBRARY}")
+if(NOT EXISTS "${OPENSSL_CRYPTO_LIBRARY}")
+  message(FATAL_ERROR "OpenSSL crypto library file does not exist: ${OPENSSL_CRYPTO_LIBRARY}")
+endif()
+
+# Workaround for local OpenSSL builds by default expecting that their
+# dynamic libs have been installed in ./${LIB}.
+# See for binaries dynamically linked to OpenSSL the output of 'ldd <binary>'
+if(CMAKE_SYSTEM_NAME MATCHES "Windows")
+  set(USERS "^(\w:)?\\Users\\")
+  set(LIB "bin")
+else()
+  set(USERS "^/(home|Users)/")
+  set(LIB "lib")
+endif()
+string(REGEX MATCH ${USERS} MATCHED "${OPENSSL_LIB}")
+if(NOT "${MATCHED}" STREQUAL "" AND NOT EXISTS "${OPENSSL_LIB}/${LIB}")
+  execute_process(COMMAND ${CMAKE_COMMAND} -E create_symlink "." "${OPENSSL_LIB}/${LIB}")
+  # since CMake 3.13, this works also for Windows
 endif()
-message(STATUS "using OpenSSL libraries ${OPENSSL_CRYPTO_LIBRARY}, ${OPENSSL_SSL_LIBRARY}")
 
 option(SECURITY_UTILITIES_USE_UTA "Use UTA API" OFF)
 option(SECURITY_UTILITIES_USE_ICV "Use configuration ICV" OFF)
diff --git a/Makefile_v1 b/Makefile_v1
index fe9e8c9..f46a1a0 100644
--- a/Makefile_v1
+++ b/Makefile_v1
@@ -12,13 +12,20 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
-# Optional OPENSSL_DIR defines absolute or relative (to ../) path to OpenSSL installation
-# Optional OPENSSL_LIB defines where to find the OpenSSL library installation (default: OPENSSL_DIR/lib).
+# Optional OPENSSL_DIR defines where to find the OpenSSL installation
+#   with header files at include/openssl (default: will try, e.g., /usr).
+# Optional OPENSSL_LIB defines where to find the OpenSSL libraries
+#   (default: will try, e.g., OPENSSL_DIR/lib).
 # Optional CFLAGS and LDFLAGS are appended by local settings.
 # Optional DEBUG_FLAGS may set to prepend to local CFLAGS and LDFLAGS (default see below).
 # Builds are done in release mode if optional NDEBUG is defined.
-# Optional OUT_DIR defines absolute or relative (to ./) path where to place the library.
+# Optional OUT_DIR defines where to place the resulting library (default: '.').
 # Optional DESTDIR defines a prefix for the installation target directories.
+# All paths may be absolute or relative to the directory containing this Makefile.
+
+SHELL=bash # This is needed for supporting extended file name globbing
+
+# variables ####################################################################
 
 ROOTFS ?= $(DESTDIR)$(prefix)
 
@@ -31,39 +38,87 @@ VERSION=2.0
 # PACKAGENAME=libsecutils
 # DIRNAME=$(PACKAGENAME)-$(VERSION)
 
-SHELL=bash # This is needed for supporting extended file name globbing
-
-ifeq ($(OS),Windows_NT)
+# https://stackoverflow.com/questions/714100/os-detecting-makefile
+ifeq ($(OS),Windows_NT) # strange but apparently this string is used also for all later versions
+    # so far, we do not support Windows, but trying to continue anyway
+    override OS=Windows
+    USERS='^([[:alpha:]]:)?\\Users\\'
     EXE=.exe
     DLL=.dll
+    SONAME=
+    LDD=TODO
     OBJ=.obj
     LIB=bin
 else
     EXE=
     OBJ=.o
     LIB=lib
+    override OS = $(shell sh -c 'uname 2>/dev/null || echo Unknown')
+    USERS='^/(home|Users)/'
     ifeq ($(shell uname -s),Darwin)
-        OS=MacOS
+        override OS=MacOS
         DLL=.dylib
         SONAME=install_name,@rpath/
-    else # assuming Linux
+        LDD=otool -l
+    else # assuming other Unix-like
         DLL=.so
         SONAME=soname,
+        LDD=ldd
     endif
 endif
 
-ifeq ($(OPENSSL_DIR),)
-    OPENSSL_DIR=$(ROOTFS)/usr
+ifneq ($(filter-out doc install uninstall clean clean_config clean_all clean_uta clean_deb,$(MAKECMDGOALS)),)
+ifeq ($(OPENSSL_DIR),) # for convenience, use heuristics to determine OPENSSL_DIR
+    ifeq ($(OS),MacOS)
+        SYSTEM_INCLUDE_OPENSSL=/opt/homebrew/include/openssl # usually symlink
+    else # TODO for Windows
+        SYSTEM_INCLUDE_OPENSSL=/usr/include/openssl
+    endif
+    OPENSSL_INCLUDE_DIR = $(realpath $(SYSTEM_INCLUDE_OPENSSL))
+    override OPENSSL_DIR = $(realpath $(OPENSSL_INCLUDE_DIR)/../..)
 endif
-ifeq ($(shell echo $(OPENSSL_DIR) | grep "^/"),)
-# $(OPENSSL_DIR) is relative path, assumed relative to ../
-    OPENSSL=../$(OPENSSL_DIR)
-    OPENSSL_LIB ?= ../$(OPENSSL_DIR)
-else
-# $(OPENSSL_DIR) is absolute path
-    OPENSSL=$(OPENSSL_DIR)
-    OPENSSL_LIB ?= $(OPENSSL_DIR)
+ifneq ($(OPENSSL_DIR),) # due to the above, always true
+    LIB_NAME_PATTERN=libcrypto*$(DLL)*
+    ifeq ($(realpath $(OPENSSL_DIR)),)
+        $(error OPENSSL_DIR appears to be an invalid path: $(OPENSSL_DIR))
+    endif
+    override OPENSSL_DIR := $(realpath $(OPENSSL_DIR))
+
+    ifeq ($(OPENSSL_LIB),) # for convenience, use heuristics to determine OPENSSL_LIB
+        override OPENSSL_LIB = $(OPENSSL_DIR)/$(LIB)
+        ifeq ($(wildcard $(OPENSSL_LIB)/$(LIB_NAME_PATTERN)),)
+            $(warning Warning: cannot find OpenSSL libraries at determined location $(OPENSSL_LIB), now trying $(OPENSSL_DIR))
+            override OPENSSL_LIB = $(OPENSSL_DIR)
+            ifeq ($(wildcard $(OPENSSL_LIB)/$(LIB_NAME_PATTERN)),)
+                ifeq ($(OS),Linux)
+	            ifeq ($(shell echo $(OPENSSL_DIR) | grep -E '^/(home|Users)'),)
+                        override OPENSSL_LIB = $(wildcard /lib/*linux-gnu*)
+                        $(warning Warning: cannot find OpenSSL libraries at $(OPENSSL_DIR), now trying $(OPENSSL_LIB))
+                    endif
+                endif
+            endif
+        endif
+    else
+        ifeq ($(wildcard $(OPENSSL_LIB)/$(LIB_NAME_PATTERN)),)
+            # $(warning Warning: cannot find OpenSSL libraries at given OPENSSL_LIB $(OPENSSL_LIB), now trying OPENSSL_DIR)
+            override OPENSSL_LIB = $(OPENSSL_DIR)
+        endif
+    endif
+    # ifeq ($(findstring $(USERS),$(OPENSSL_FULL_DIR)),)
+    #     $(warning [DEBUG] OPENSSL_DIR is assumed to be an installation directory)
+    # else
+    #     $(warning [DEBUG] OPENSSL_DIR is assumed to be a local build directory)
+    # endif
+    ifeq ($(wildcard $(OPENSSL_LIB)/$(LIB_NAME_PATTERN)),)
+        $(error Error: cannot find OpenSSL library $(LIB_NAME_PATTERN) at $(OPENSSL_LIB)/)
+    endif
+    override OPENSSL_LIB := $(realpath $(OPENSSL_LIB))
+endif
+ifeq ($(wildcard $(OPENSSL_DIR)/include/openssl),)
+    $(error cannot find directory '$(OPENSSL_DIR)/include/openssl', check OPENSSL_DIR variable)
 endif
+endif # neq ($(filter-out doc install uninstall clean clean_config clean_all clean_uta clean_deb,$(MAKECMDGOALS)),)
+
 
 ################################################################################
 # Basic definitions targeted at debugging
@@ -73,10 +128,10 @@ endif
 ################################################################################
 
 ifdef NDEBUG
-    DEBUG_FLAGS ?= -O2
-    override DEBUG_FLAGS += -DNDEBUG=1
+    override DEBUG_FLAGS ?= -O2
+    override DEBUG_FLAGS += -DNDEBUG=1 -Werror
 else
-    DEBUG_FLAGS ?= -g -O0 -fsanitize=address -fsanitize=undefined -fno-sanitize-recover=all # not every compiler(version) supports -Og
+    override DEBUG_FLAGS ?= -g -O0 -fsanitize=address -fsanitize=undefined -fno-sanitize-recover=all # not every compiler(version) supports -Og
 endif
 override CFLAGS += $(DEBUG_FLAGS) \
  -Wall -Woverflow -Wextra -Wswitch -Wmissing-prototypes -Wstrict-prototypes \
@@ -84,8 +139,8 @@ override CFLAGS += $(DEBUG_FLAGS) \
  -Wsign-compare -Wpointer-arith -Wunused-parameter
 # TODO clean up code and re-enable warnings instead:
 override CFLAGS += -Wno-conversion -Wno-sign-conversion \
- -Wno-shadow -Wno-declaration-after-statement -Wno-vla
-override CFLAGS += -pedantic -DPEDANTIC -Werror
+ -Wno-shadow -Wno-declaration-after-statement -Wno-vla -Wno-gnu-folding-constant
+override CFLAGS += -pedantic -DPEDANTIC
 
 ################################################################################
 # Obligatory flags
@@ -94,7 +149,7 @@ override CFLAGS += -pedantic -DPEDANTIC -Werror
 ################################################################################
 
 CC ?= gcc
-OUTLIB_=libsecutils
+override OUTLIB_= libsecutils
 OUTLIB=$(OUTLIB_)$(DLL)
 ifeq ($(OS),MacOS)
     OUTLIBV=$(OUTLIB_).$(VERSION)$(DLL)
@@ -109,7 +164,7 @@ DEST_DOC=$(DEST_PRE)/share/doc/libsecutils-dev
 OUTBIN=icvutil$(EXE)
 DEST_BIN=$(DEST_PRE)/bin
 LOCAL_CFLAGS= -fPIC # -std=gnu90 TODO clean up code and re-enable flag
-override CFLAGS += -isystem $(OPENSSL)/include# # # use of -isystem is critical for selecting wanted OpenSSL version
+override CFLAGS += -isystem $(OPENSSL_DIR)/include# # use of -isystem is critical for selecting wanted OpenSSL version
 override CFLAGS += -Isrc/libsecutils/include
 override CFLAGS += -Isrc/libsecutils/include/secutils
 ifneq ($(SECUTILS_USE_UTA),)
@@ -120,12 +175,9 @@ ifneq ($(SECUTILS_USE_ICV),)
 endif
 
 override LDFLAGS += $(DEBUG_FLAGS) # needed for -fsanitize=...
-override LDFLAGS += -L $(OPENSSL_LIB) -L $(OPENSSL)
+override LDFLAGS += -L $(OPENSSL_LIB)
 ifeq ($(DEB_TARGET_ARCH),) # not during Debian packaging
   override LDFLAGS += -Wl,-rpath,$(OPENSSL_LIB)
-  ifneq ($(OPENSSL_LIB),$(OPENSSL))
-    override LDFLAGS += -Wl,-rpath,$(OPENSSL)
-  endif
 endif
 ifneq ($(SECUTILS_USE_UTA),)
     override LDFLAGS += -luta
@@ -167,12 +219,22 @@ OBJS := $(patsubst %.c,$(BUILDDIR)/%$(OBJ),$(notdir $(wildcard src/libsecutils/s
 # Targets
 ################################################################################
 
+# building #####################################################################
+
 # Phony (non-file) targets
 .PHONY: all doc util build build_only build_all clean clean_config clean_all clean_uta install uninstall deb clean_deb coverage
 
 # Default target
 all: build_all doc
 
+$(OUT_DIR):
+	@mkdir -p $(OUT_DIR)
+
+ifneq ($(findstring build_only,$(MAKECMDGOALS)),)
+    $(info Build info: source directory is $(PWD))
+    $(info detected OpenSSL base directory $(OPENSSL_DIR))
+    $(info detected OpenSSL lib  directory $(OPENSSL_LIB))
+endif
 build_only: $(OUT_DIR)/$(OUTLIB)
 
 build:
@@ -212,7 +274,7 @@ endif
 $(OUT_DIR)/$(OUTLIBV): $(OBJS)
 	$(CC) $(OBJS) $(LDFLAGS) -shared -o $@ -Wl,-$(SONAME)$(OUTLIBV)
 
-$(OUT_DIR)/$(OUTLIB): $(OUT_DIR)/$(OUTLIBV)
+$(OUT_DIR)/$(OUTLIB): $(OUT_DIR)/$(OUTLIBV) fix_build_lib
 	ln -sf $(OUTLIBV) $(OUT_DIR)/$(OUTLIB)
 
 # Individual object targets; also provide dependencies on header files of the project (not on system headers)
@@ -232,6 +294,23 @@ $(BUILDDIR):
 # (directories are flagged as changed on every object build)
 $(OBJS): | $(BUILDDIR)
 
+# workaround for using local OpenSSL builds by default expecting that
+# its dynamic libs have been installed in ./$(LIB) when using the libs
+# see for binaries that dynamically link to OpenSSL the output of $(LDD) <binary>
+.PHONY: fix_build_lib
+fix_build_lib:
+ifneq ($(shell echo $(realpath $(OPENSSL_LIB)) | grep -E $(USERS)),)
+    ifeq ($(OPENSSL_LIB),$(OPENSSL_DIR))
+	@cd "$(OPENSSL_DIR)"; if [ ! -e $(LIB) ]; then ln -s . $(LIB); fi
+	@ # alternative would be to use, e.g.,
+	@ # install_name_tool -change $(OPENSSL_DIR)/lib/libcrypto.3.dylib $(OPENSSL_DIR)/libcrypto.3.dylib <libname>
+    endif
+endif
+	@true # prevent warning "Nothing to be done for `fix_build_lib'."
+
+
+# Debian packaging #############################################################
+
 deb:
 	debuild -e OPENSSL_DIR="$(OPENSSL_DIR)" -e OPENSSL_LIB="$(OPENSSL_LIB)" \
 	  --preserve-envvar SECUTILS_NO_TLS \
@@ -248,6 +327,9 @@ clean_deb:
 	rm -fr _CPack_Packages changelog.gz
 	rm -f libsecutils*.{deb,tar.gz,zip}
 
+
+# installation #################################################################
+
 # installation target - append ROOTFS=<path> to install into virtual root
 # filesystem
 install: # doc/html $(OUT_DIR)/$(OUTLIB) $(OUT_DIR)/$(OUTBIN)
@@ -277,6 +359,9 @@ uninstall:
 	rm -f $(DEST_BIN)/$(OUTBIN)
 	rm -rf $(DEST_DOC)/doc/html
 
+
+# cleaning #####################################################################
+
 clean_uta:
 	rm -fr $(BUILDDIR)/uta_api$(OBJ) $(BUILDDIR)/files_icv$(OBJ) \
           $(BUILDDIR)/files_dv$(OBJ) \
@@ -296,12 +381,15 @@ clean_all: clean clean_deb
 	  -not -path ./src/libsecutils/security-utilities_libraryConfig.cmake \
 	  -not -path ./src/util/security-utilities_icvutilConfig.cmake \
 	  -not -path ./coverage/Makefile \
-	  | xargs rm
-	find . -name CMakeFiles | xargs rm -r
+	  | xargs rm 2>/dev/null || true
+	find . -name CMakeFiles | xargs rm -r 2>/dev/null || true
 	rm -f install_manifest*.txt
 	rm -fr doc refman.pdf CMakeDoxyfile.in Doxyfile.security-utilities_doxygen Doxyfile.doc *.gcov reports
 	rm -fr _CPack_Packages Makefile CMakeCache.txt
 
+
+# documentation ################################################################
+
 doc: $(SECUTILS_CONFIG) doc/html refman.pdf
 
 doc/html: Doxyfile $(wildcard src/libsecutils/include/*/*.h src/libsecutils/include/*/*/*.h)
@@ -312,5 +400,8 @@ refman.pdf: doc/html
 	@# for producing doc/latex/*, comment out in Doxyfile: GENERATE_LATEX = NO
 	@# $(MAKE) -C -f Makefile_v1 doc/latex && cp -a doc/latex/refman.pdf . # requires latex
 
+
+# others #######################################################################
+
 coverage: clean
 	$(MAKE) -f Makefile_v1 COMPILE_TYPE=code_coverage
diff --git a/README.md b/README.md
index b6426a1..d3305fa 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,4 @@
-# libsecutils
+# libSecUtils
 
 <img src="libsecutils.svg" width="200">
 
@@ -48,16 +48,16 @@ also on a virtual machine or the Windows Subsystem for Linux ([WSL](https://docs
 and with MacOS.
 
 The following network and development tools are needed or recommended.
-* Git (for getting the software, tested with versions 2.7.2, 2.11.0, 2.20, 2.30.2, 2.39.2)
-* CMake (for using [`CMakeLists.txt`](CMakeLists.txt), tested with versions 3.18.4, 3.26.3, 3.27.7)
-* GNU make (tested with versions 3.81, 4.1, 4.2.1, 4.3)
-* GNU C compiler (gcc, tested with versions 5.4.0, 7.3.0, 8.3.0, 10.0.1, 10.2.1)
-  or clang (tested with version 14.0.3 and 17.0.3)
+* Git (for getting the software, tested versions include 2.7.2, 2.11.0, 2.20, 2.30.2, 2.39.2, 2.47.0)
+* CMake (for using [`CMakeLists.txt`](CMakeLists.txt), tested versions include 3.18.4, 3.26.3, 3.27.7, 3.30.5)
+* GNU make (tested versions include 3.81, 4.1, 4.2.1, 4.3)
+* GNU C compiler (gcc, tested versions include 5.4.0, 7.3.0, 8.3.0, 10.0.1, 10.2.1, 12.2.0)
+  or clang (tested versions include 14.0.3, 17.0.3, 19.1.1)
 
 The following OSS components are used.
-* OpenSSL development edition, at least version 1.1.1. Tested, among others,
-  with 1.0.2u, 1.1.0f, 1.1.0g, 1.1.1d, 1.1.1i, 1.1.1l, and 3.0.0.<br>
-  **Warning:** OpenSSL 1.1.1 (on Mint 19) contains a bug where used cipher suite (level 3) is empty (1.1.1d on Buster works correctly)
+* OpenSSL development edition, at least version 3.0. Tested, among others,
+  with <!-- 1.0.2u, 1.1.0f, 1.1.0g, 1.1.1d, 1.1.1i, 1.1.1l,--> 3.0, 3.1, 3.2, 3.3, 3.4.<br>
+  <!-- **Warning:** OpenSSL 1.1.1 (on Mint 19) contains a bug where used cipher suite (level 3) is empty (1.1.1d on Buster works correctly) -->
 
 * optionally: [github.com/siemens/libuta](https://github.com/siemens/libuta)
 
@@ -75,15 +75,25 @@ including the C header files needed for development
 (as provided by, e.g., the Debian/Ubuntu package `libssl-dev`).
 
 By default any OpenSSL installation available on the system is used.
-Set the optional environment variable `OPENSSL_DIR` to specify the
-absolute (or relative to `../`) path of the OpenSSL installation to use, e.g.:
+
+It is recommended to set the optional environment variable `OPENSSL_DIR` to specify
+the absolute or relative path of the OpenSSL installation or local build directory to use, e.g.,
 ```
 export OPENSSL_DIR=/usr/local
 ```
-In case its libraries are in a different location, set also `OPENSSL_LIB`, e.g.:
+or some heuristics will try to detect the location.
+This must point to the location in the file system from which the subdirectory `include/openssl`
+is directly accessible (using this relative path name).\
+When used with CMake, `$OPENSSL_DIR/OpenSSLConfig.cmake` must exist.
+
+In case the OpenSSL libraries are in an unusual location, set also `OPENSSL_LIB`, e.g.,
 ```
-export OPENSSL_LIB=$OPENSSL_DIR/lib
+export OPENSSL_LIB=/lib/aarch64-linux-gnu
 ```
+Otherwise some heuristics will try to detect the location.
+
+For all environment variables specifying a directory, relative paths such as `.`
+are interpreted relative to the libSecUtils source directory.
 
 Use of the UTA library can be enabled
 by setting the environment variable `SECUTILS_USE_UTA`.
@@ -99,8 +109,9 @@ for instance as follows:
 ```
 cmake .
 ```
-When using CMake, `cmake` must be (re-)run
-after setting or unsetting environment variables.
+After modifying (i.e., setting or unsetting) relevant environment variables,
+it is recommended to remove `CMakeCache.txt` and re-run CMake.
+
 By default, CMake builds are in Release mode.
 This may also be enforced by defining the environment variable `NDEBUG`.
 For switching to Debug mode, use `cmake` with `-DCMAKE_BUILD_TYPE=Debug`.
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index efa4b46..0d333aa 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -3,11 +3,12 @@ target_compile_options(secutils_compilation_options INTERFACE
     -Wall -Woverflow -Wextra -Wswitch -Wmissing-prototypes -Wstrict-prototypes
     -Wformat -Wformat-security -Wtype-limits -Wundef
     -Wsign-compare -Wpointer-arith -Wunused-parameter
-    -pedantic -Werror
+    -pedantic
+    # -Werror is enabled only for development and CI using Makefile_v1 without NDEBUG
 
     # TODO clean up code and re-enable warnings instead:
     -Wno-conversion -Wno-sign-conversion -Wno-c99-extensions
-    -Wno-shadow -Wno-declaration-after-statement -Wno-vla
+    -Wno-shadow -Wno-declaration-after-statement -Wno-vla -Wno-gnu-folding-constant
 )
 target_compile_definitions(secutils_compilation_options INTERFACE PEDANTIC)
 
diff --git a/src/libsecutils/src/storage/files.c b/src/libsecutils/src/storage/files.c
index bc336b3..fe80a06 100644
--- a/src/libsecutils/src/storage/files.c
+++ b/src/libsecutils/src/storage/files.c
@@ -1,20 +1,20 @@
-/** 
+/**
 * @file files.c
-* 
+*
 * @brief Private key, certificate, CSR (PKCS#10), and CRL file handling
 *
 * @copyright Copyright (c) Siemens Mobility GmbH, 2021
 *
 * @author David von Oheimb <david.von.oheimb@siemens.com>
 *
-* This work is licensed under the terms of the Apache Software License 
+* This work is licensed under the terms of the Apache Software License
 * 2.0. See the COPYING file in the top-level directory.
 *
 * SPDX-License-Identifier: Apache-2.0
 */
 
 #define OPENSSL_NO_RC4 /* prevent errors on undeclared FORMAT_MSBLOB and FORMAT_PVK */
-#define OSSL_DEPRECATEDIN_3_1
+//#define OSSL_DEPRECATEDIN_3_1
 #include <openssl/pem.h>
 #include <openssl/pkcs12.h>
 #ifndef OPENSSL_NO_ENGINE