Re: How to test a build of the FIPS provider

Could you describe "its API".

I build in /home/openssl.

I set these to point there:

LD_LIBRARY_PATH
LIBRARY_PATH
CPATH
PATH

I set the linker to:

-L/home/openssl -Wl,-rpath,. -lcrypto

These all fail:

     fips = OSSL_PROVIDER_load(NULL, "fips");
     sha256 = EVP_MD_fetch(NULL, "SHA2-256", "fips=yes");
     sha256 = EVP_MD_fetch(NULL, "SHA2-256", "provider=fips");


On 1/20/2026 4:22 PM, Igor Ustinov wrote:
> It is not expected that an application will be linked with a provider 
> directly; instead, link your application with libcrypto and use the 
> provider via its API.
> 
> On Tue, 20 Jan 2026 at 20:30, Ken Goldman <kgoldman wrote:
> 
>     I know I can install there, but how does my C application and makefile
>     point to it.
> 
>     E.g., the fips provider is fips.so, not libfips.so, so I cannot simply
>     link with -lfips.
> 
>     On 1/20/2026 3:09 AM, Igor Ustinov wrote:
>      > You can build OpenSSL to be installed in a separate directory, e.g.
>      > $HOME/openssl, by calling Configure with parameters --prefix=$HOME/
>      > openssl --libdir=lib --openssldir=$HOME/openssl -Wl,-rpath,$HOME/
>     openssl/lib
>      >
>      > On Tue, 20 Jan 2026 at 00:49, Ken Goldman <kgoldman wrote:
>      >
>      >     Fedora 42, x86 - I built openssl 3.6.1 with enable-fips and
>     got fips.so
>      >
>      >     I'd like to test it locally, as non-root, but not install it
>     in the
>      >     system area. Are there instructions for this?
>      >
>      >     I want to test the EVP API, not TLS or the command line.
>      >
> 

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/80de5e3f-6b25-4668-b2a8-318e5fc10a02%40us.ibm.com.