Re: How to test a build of the FIPS provider

First of all, I'd like to clarify that you can install your custom build of
OpenSSL into your home directory. Although it is technically an
installation, it doesn't require root privileges and will not affect any
existing application.
To do it, you need to configure OpenSSL with parameters
--prefix=$HOME/myopenssl --libdir=lib --openssldir=$HOME/myopenssl
-Wl,-rpath,$HOME/myopenssl/lib
and after that
make
make install
You will have your build of OpenSSL in the myopenssl directory in your
home. It will not affect any existing applications.
To link your application that uses the EVP API with this build, you need to
use the linker parameters
 -L$HOME/myopenssl/lib -Wl,-rpath=$HOME/myopenssl/lib -lcrypto
After that, your application (and only this application) will use your
build of OpenSSL instead of the system one.
If you want your application to work with the FIPS provider, you also need
to edit the configuration file $HOME/myopenssl/ssl/openssl.cnf to load the
FIPS provider.

On Mon, 26 Jan 2026 at 22:22, Ken Goldman <kgoldman-r/[email protected]> wrote:

> My requirement is to NOT install. I'm told that installing a
> new openssl on Linux can break applications.
>
> To summarize:
>
> - not as root
> - not installed in the system area
> - C EVP API, not command line
>
> On 1/22/2026 2:10 AM, Igor Ustinov wrote:
> > There are two OpenSSL directories: the build directory where you build
> > OpenSSL, and the install directory where OpenSSL will be installed if
> > you call
> > make install.
> > Viktor and I describe two different approaches: Viktor prefers to link
> > an application directly with the library in the build directory, and I
> > prefer to install OpenSSL first and then link an application with the
> > installed library. You can choose one of these approaches that you like
> > more.
> > If you choose Viktor's way, follow his instructions.
> > If you choose my way, set the install directory by Configure with
> parameters
> > --prefix=$MYPATH --libdir=lib --openssldir=$MYPATH -Wl,-rpath,$MYPATH/lib
> > (change $MYPATH to the desired install directory path or set MYPATH
> > variables in advance),
> > build and install OpenSSL,
> > link your application with the installed library by using parameters
> > -L$MYPATH/lib -Wl,-rpath=$MYPATH/lib -lcrypto
> >
> >
> > On Thu, 22 Jan 2026 at 00:16, Ken Goldman <kgoldman-r/
> > [email protected] <mailto:kgoldman-r/
> > [email protected]>> wrote:
> >
> >     When I do a build (configure, make), there is no
> >     /home/openssl/lib.
> >
> >     The top level /home/openssl has libcrypto.so.
> >
> >     The fips library is in /home/openssl/providers/fips.so
> >     but I don't know how to link to it.
> >
> >
> >
> >     On 1/21/2026 2:23 AM, Igor Ustinov wrote:
> >      > The linker options should be
> >      > -L/home/openssl/lib -Wl,-rpath=/home/openssl/lib -lcrypto
> >      > (providing /home/openssl is the correct path).
> >      >
> >      > On Tue, 20 Jan 2026 at 23:26, Ken Goldman <kgoldman-r/
> >     [email protected] <mailto:kgoldman-r/
> >     [email protected]>
> >      > <mailto:kgoldman-r/[email protected]
> >     <mailto:kgoldman-r/[email protected]>>> wrote:
> >      >
> >      >     Could you describe "its API".
> >      >
> >      >     I build in /home/openssl.
> >      >
> >      >     I set these to point there:
> >      >
> >      >     LD_LIBRARY_PATH
> >      >     LIBRARY_PATH
> >      >     CPATH
> >      >     PATH
> >      >
> >      >     I set the linker to:
> >      >
> >      >     -L/home/openssl -Wl,-rpath,. -lcrypto
> >      >
> >      >     These all fail:
> >      >
> >      >           fips = OSSL_PROVIDER_load(NULL, "fips");
> >      >           sha256 = EVP_MD_fetch(NULL, "SHA2-256", "fips=yes");
> >      >           sha256 = EVP_MD_fetch(NULL, "SHA2-256",
> "provider=fips");
> >      >
> >      >
> >      >     On 1/20/2026 4:22 PM, Igor Ustinov wrote:
> >      >      > It is not expected that an application will be linked with
> a
> >      >     provider
> >      >      > directly; instead, link your application with libcrypto
> >     and use the
> >      >      > provider via its API.
> >      >      >
> >      >      > On Tue, 20 Jan 2026 at 20:30, Ken Goldman <kgoldman wrote:
> >      >      >
> >      >      >     I know I can install there, but how does my C
> >     application and
> >      >     makefile
> >      >      >     point to it.
> >      >      >
> >      >      >     E.g., the fips provider is fips.so, not libfips.so, so
> I
> >      >     cannot simply
> >      >      >     link with -lfips.
> >      >      >
> >      >      >     On 1/20/2026 3:09 AM, Igor Ustinov wrote:
> >      >      >      > You can build OpenSSL to be installed in a separate
> >      >     directory, e.g.
> >      >      >      > $HOME/openssl, by calling Configure with parameters
> --
> >      >     prefix=$HOME/
> >      >      >      > openssl --libdir=lib --openssldir=$HOME/openssl
> -Wl,-
> >      >     rpath,$HOME/
> >      >      >     openssl/lib
> >      >      >      >
> >      >      >      > On Tue, 20 Jan 2026 at 00:49, Ken Goldman <kgoldman
> >     wrote:
> >      >      >      >
> >      >      >      >     Fedora 42, x86 - I built openssl 3.6.1 with
> enable-
> >      >     fips and
> >      >      >     got fips.so
> >      >      >      >
> >      >      >      >     I'd like to test it locally, as non-root, but
> not
> >      >     install it
> >      >      >     in the
> >      >      >      >     system area. Are there instructions for this?
> >      >      >      >
> >      >      >      >     I want to test the EVP API, not TLS or the
> >     command line.
> >      >      >      >
> >      >      >
> >      >
> >
>
> --
> You received this message because you are subscribed to the Google Groups
> "openssl-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
> To view this discussion visit
> https://groups.google.com/a/openssl.org/d/msgid/openssl-users/10l8lti%24lvr%241%40ciao.gmane.io
> .
>


-- 
*Igor Ustinov*
Senior Software Engineer, OpenSSL Foundation
<http://openssl-foundation.org/>

Join the Code Protectors <https://openssl-foundation.org/donate/corporate/>
| Support us on Github Sponsors <https://github.com/sponsors/openssl>

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/CACdz_dHcadooEQPgCnZ0UFPJR_1qG%3DihDeFgyqCAZOVR1qvGmQ%40mail.gmail.com.