Re: How to test a build of the FIPS provider

On Tue, Jan 20, 2026 at 05:26:12PM -0500, Ken Goldman wrote:

> Could you describe "its API".

Apologies for the poor advice you've seen so far...

Trying to make amends:

Providers are generally expected to be loaded via
the configuration file.  In particular, for the
FIPS provider you'll need:

    - A configuration file that requests that the FIPS
      provider be loaded and used.

    - A "modules"/ directory containing the "fips.so"
      shared executable.

    - A "fipsmodule.cnf" file created by "openssl fipsinstall".
      This is normally installed by "make install_fips".

        $ make -n install_fips
        [...]
        cp "providers/fips.so" "/usr/local/lib64/ossl-modules/fips.so.new"
        chmod 755 "/usr/local/lib64/ossl-modules/fips.so.new"
        mv -f "/usr/local/lib64/ossl-modules/fips.so.new" \
               "/usr/local/lib64/ossl-modules/fips.so"
        cp providers/fipsmodule.cnf "/usr/local/ssl/fipsmodule.cnf"

As a base config example, look at "test/fips-and-base.cnf"
(the base64 cruft in the demo script is a condensed version).

Demo script below my signature.  At the bottom of that script
you can add any additional tests of your choice.

-- 
    Viktor.  🇺🇦 Слава Україні!

#! /bin/sh
set -e

DIR="$(mktemp -td ossl-test-dir.XXXXXX)"
TLOG="${DIR}/test.log"
CDIR="${DIR}/ssl"
LDIR="${DIR}/lib"
MDIR="${LDIR}/ossl-modules"
DSO="${MDIR}/fips.so"
mkdir -p "${CDIR}" "${MDIR}"

install -m 0755 providers/fips.so "${DSO}"

./util/wrap.pl ./apps/openssl fipsinstall \
    -module "${DSO}" \
    -out "${CDIR}/fipsmodule.cnf" \
    -provider_name fips 2>"${TLOG}"

./util/wrap.pl ./apps/openssl fipsinstall \
    -module "${DSO}" \
    -in "${CDIR}/fipsmodule.cnf" \
    -provider_name fips \
    -verify >> "$TLOG" 2>&1

(
    printf "%s\n%s\n%s\n%s\n" \
    H4sIAGBwcGkAA1VOXQrDIAx+zymkByjsAD2JSHEaR8CpGBV2+8V1G+1Tvt8kuWBi \
    jrvLKahN5S+lRA1WSi52jypQ4Wf2PeLqUgB9ThkoNQ/yWFn6P7wzugY2Pj6AchIP \
    R9nFL1gbIYO+cgMeg+2xnTQpLfP29kJeQF+WG5iOJOY4zt0towhzHIL+QwNW3hi2 \
    zcAN3r6sTF/2AAAA
) |
    openssl base64 -d |
    gunzip -c > "${CDIR}/openssl.cnf"

if openssl dgst -sha256 </dev/null
    then : ok
    else { printf "Unexpected sha256 failure\n" >&2; false; }; fi
if openssl dgst -ripemd </dev/null
    then : ok
    else { printf "Unexpected ripemd failure\n" >&2; false; }; fi

export OPENSSL_CONF="${CDIR}/openssl.cnf"
export OPENSSL_CONF_INCLUDE="${CDIR}"
export OPENSSL_MODULES="${MDIR}"
./util/wrap.pl ./apps/openssl fipsinstall -config "${OPENSSL_CONF}"

if openssl dgst -sha256 </dev/null
    then : ok
    else { printf "Unexpected sha256 failure\n" >&2; false; }; fi
if openssl dgst -ripemd </dev/null 2>/dev/null
    then { printf "Unexpected ripemd success\n" >&2; false; }
    else : ok; fi

# ... More tests here ...

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/aXB9ES_di9NMuCmV%40chardros.imrryr.org.