Re: How to test a build of the FIPS provider

On 1/27/2026 7:51 PM, Viktor Dukhovni wrote:
> On Tue, Jan 27, 2026 at 05:37:06PM -0500, Ken Goldman wrote:
>
> This installs the "fipsmodule.cnf" and "fips.so" files, but
> does not update "openssl.cnf", which is still required to
> "enable" activation of the provider.
> 
> When the ".include" filename is a "relative" filename the directory
> searched sadly does not default to either the one containing the
> configuration file with the ".include" or the directory reported by
> "openssl version -d".  Rather, you one of the below is needed:
> 
>      - Setting the OPENSSL_CONF_INCLUDE environment variable to
>        the directory containing "fipsmodule.cnf"
> 
>          export OPENSSL_CONF_INCLUDE=/some/where/ssl
> 
>      - Adding a configuration pragma that specifies the base path
>        of relative include file names.
> 
>          .pragma includedir:/some/where

The .pragma works.  I had used a full path name, which also works.

> 
> My configuration file for FIPS module tests has the below diff relative
> to fthe stock "openssl.cnf" installed by "make install_ssldirs":
> 
> --- openssl.cnf	2026-01-28 11:24:26.969524459 +1100
> +++ fips.cnf	2026-01-28 11:35:46.611998701 +1100
> @@ -17,2 +17,4 @@
>   openssl_conf = openssl_init
> +.pragma includedir:/opt/openssl/master/ssl
> +.include fipsmodule.cnf
>   
> @@ -57,6 +59,4 @@
>   [provider_sect]
> -default = default_sect
> -# The fips section name should match the section name inside the
> -# included fipsmodule.cnf.
> -# fips = fips_sect
> +base = default_sect
> +fips = fips_sect
>   
> @@ -71,4 +71,3 @@
>   [default_sect]
> -# activate = 1
> -
> +activate = 1
>   
>> It feels like I'm missing a step. How does my application (via
>> configuration files) point to
>>
>> 	lib/ossl-modules/fips.so
> 
> As posted upthread, that requires either:
> 
>      - Setting the OPENSSL_MODULES environment variable:
> 
>          export OPENSSL_MODULES=/some/where/lib/ossl-modules
> 
>      - Adding an explicit module path to the fipsmodule.cnf file:
> 
>        fipsmodule.cnf:
>          [fips_sect]
>          module = /some/where/lib/ossl-modules/fips.so

Thank you.  This is the step I was missing.



-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/10ldqmj%24k7s%241%40ciao.gmane.io.