Re: How to test a build of the FIPS provider

On Tue, Jan 27, 2026 at 05:37:06PM -0500, Ken Goldman wrote:

> > the configuration file.  In particular, for the
> > FIPS provider you'll need:
> > 
> >      - A configuration file that requests that the FIPS
> >        provider be loaded and used.

> It's still not finding the fips module. I ran this:
> 
> 	make install_fips

This installs the "fipsmodule.cnf" and "fips.so" files, but
does not update "openssl.cnf", which is still required to
"enable" activation of the provider.

> And uncommented these in openssl.cnf
> 
> 	.include fipsmodule.cnf
> 	fips = fips_sect

When the ".include" filename is a "relative" filename the directory
searched sadly does not default to either the one containing the
configuration file with the ".include" or the directory reported by
"openssl version -d".  Rather, you one of the below is needed:

    - Setting the OPENSSL_CONF_INCLUDE environment variable to
      the directory containing "fipsmodule.cnf"

        export OPENSSL_CONF_INCLUDE=/some/where/ssl

    - Adding a configuration pragma that specifies the base path
      of relative include file names.

        .pragma includedir:/some/where

My configuration file for FIPS module tests has the below diff relative
to fthe stock "openssl.cnf" installed by "make install_ssldirs":

--- openssl.cnf	2026-01-28 11:24:26.969524459 +1100
+++ fips.cnf	2026-01-28 11:35:46.611998701 +1100
@@ -17,2 +17,4 @@
 openssl_conf = openssl_init
+.pragma includedir:/opt/openssl/master/ssl
+.include fipsmodule.cnf
 
@@ -57,6 +59,4 @@
 [provider_sect]
-default = default_sect
-# The fips section name should match the section name inside the
-# included fipsmodule.cnf.
-# fips = fips_sect
+base = default_sect
+fips = fips_sect
 
@@ -71,4 +71,3 @@
 [default_sect]
-# activate = 1
-
+activate = 1
 
> It feels like I'm missing a step. How does my application (via
> configuration files) point to
> 
> 	lib/ossl-modules/fips.so

As posted upthread, that requires either:

    - Setting the OPENSSL_MODULES environment variable:

        export OPENSSL_MODULES=/some/where/lib/ossl-modules

    - Adding an explicit module path to the fipsmodule.cnf file:

      fipsmodule.cnf:
        [fips_sect]
        module = /some/where/lib/ossl-modules/fips.so
        ...

> I also tried adding
> 
> 	[evp_properties]
> 	default_properties = "fips=yes"

That'll only work once you're able to load the FIPS module.
Before testing your application, test the "openssl list"
command.  For example:

    $ export PATH=/opt/openssl/master/bin:$PATH

    $ export OPENSSL_CONF=/opt/openssl/master/ssl/openssl.cnf
    $ openssl list -providers
    Providers:
      default
        name: OpenSSL Default Provider
        version: 4.0.0
        status: active

    $ export OPENSSL_CONF=/opt/openssl/master/ssl/fips.cnf
    $ openssl list -providers
    Providers:
      base
        name: OpenSSL Base Provider
        version: 4.0.0
        status: active
      fips
        name: OpenSSL FIPS Provider
        version: 4.0.0
        status: active

The diff between "openssl.cnf" and "fips.cnf" is as shown above.

-- 
    Viktor.  🇺🇦 Слава Україні!

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/aXldhVil2kqBLblk%40chardros.imrryr.org.