Re: How to test a build of the FIPS provider

Michael Richardson <mcr-SWp7JaYWvAQV+D8aMU/[email protected]> Tue, 27 Jan 2026 02:23:48 -0500

Newsgroups	gmane.comp.encryption.openssl.user
Message-ID	<831180.1769498628@dyas>

Ken Goldman <kgoldman-r/[email protected]> wrote:
    > My requirement is to NOT install. I'm told that installing a new
    > openssl on Linux can break applications.

Yes, that can be the case.
But, not if you install into a very much non-standard directory (so, not
/usr/local even).   ./Configure --prefix=$HOME/myjunk etc.

The challenge is that, having installed some shared libraries there,
convincing other code (your test program) to use those shared libraries can
be a PITA.   It's possible, it's just easy to wind up with the system
librairies by mistake.

    > To summarize:

    > - not as root - not installed in the system area - C EVP API, not
    > command line

As I suggested, build with no-shared, so you get .a files, and link that.
no-shared != no-dso, and you need dso to be able to load the fips.so (or any
other provider [or engine] not built in)

I'm sure a container could help, the challenge is having one with *no* libssl,
and yet your test code build process still function if it wants to download things.
Not impossible, but annoying, especially if you then find that you want to
maybe debug something.

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/831180.1769498628%40dyas.

signature.asc (application/pgp-signature, 487 B)