Re: How to test a build of the FIPS provider

The linker options should be
-L/home/openssl/lib -Wl,-rpath=/home/openssl/lib -lcrypto
(providing /home/openssl is the correct path).

On Tue, 20 Jan 2026 at 23:26, Ken Goldman <kgoldman-r/[email protected]> wrote:

> Could you describe "its API".
>
> I build in /home/openssl.
>
> I set these to point there:
>
> LD_LIBRARY_PATH
> LIBRARY_PATH
> CPATH
> PATH
>
> I set the linker to:
>
> -L/home/openssl -Wl,-rpath,. -lcrypto
>
> These all fail:
>
>      fips = OSSL_PROVIDER_load(NULL, "fips");
>      sha256 = EVP_MD_fetch(NULL, "SHA2-256", "fips=yes");
>      sha256 = EVP_MD_fetch(NULL, "SHA2-256", "provider=fips");
>
>
> On 1/20/2026 4:22 PM, Igor Ustinov wrote:
> > It is not expected that an application will be linked with a provider
> > directly; instead, link your application with libcrypto and use the
> > provider via its API.
> >
> > On Tue, 20 Jan 2026 at 20:30, Ken Goldman <kgoldman wrote:
> >
> >     I know I can install there, but how does my C application and
> makefile
> >     point to it.
> >
> >     E.g., the fips provider is fips.so, not libfips.so, so I cannot
> simply
> >     link with -lfips.
> >
> >     On 1/20/2026 3:09 AM, Igor Ustinov wrote:
> >      > You can build OpenSSL to be installed in a separate directory,
> e.g.
> >      > $HOME/openssl, by calling Configure with parameters
> --prefix=$HOME/
> >      > openssl --libdir=lib --openssldir=$HOME/openssl -Wl,-rpath,$HOME/
> >     openssl/lib
> >      >
> >      > On Tue, 20 Jan 2026 at 00:49, Ken Goldman <kgoldman wrote:
> >      >
> >      >     Fedora 42, x86 - I built openssl 3.6.1 with enable-fips and
> >     got fips.so
> >      >
> >      >     I'd like to test it locally, as non-root, but not install it
> >     in the
> >      >     system area. Are there instructions for this?
> >      >
> >      >     I want to test the EVP API, not TLS or the command line.
> >      >
> >
>
> --
> You received this message because you are subscribed to the Google Groups
> "openssl-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
> To view this discussion visit
> https://groups.google.com/a/openssl.org/d/msgid/openssl-users/80de5e3f-6b25-4668-b2a8-318e5fc10a02%40us.ibm.com
> .
>


-- 
*Igor Ustinov*
Senior Software Engineer, OpenSSL Foundation
<http://openssl-foundation.org/>

Join the Code Protectors <https://openssl-foundation.org/donate/corporate/>
| Support us on Github Sponsors <https://github.com/sponsors/openssl>

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/CACdz_dFj%2BPXvDKaB45snir2gnWSY-2V7XWY%2B1GgWNaA4nj-3Gg%40mail.gmail.com.