Re: How to test a build of the FIPS provider

On 1/19/2026 6:49 PM, Ken Goldman wrote:
> Fedora 42, x86 - I built openssl 3.6.1 with enable-fips and got fips.so
> 
> I'd like to test it locally, as non-root, but not install it in the 
> system area. Are there instructions for this?
> 
> I want to test the EVP API, not TLS or the command line.
> 

For the record, here are working instructions, creating
a fips build in myopenssl:

./config -shared --prefix=/home/kgold/myopenssl --libdir=lib 
--openssldir=/home/kgold/myopenssl -Wl,-rpath,$HOME/myopenssl/lib 
--debug zlib enable-fips
make
	creates
	./providers/libfips.a
	./providers/fips.so
make install
	installs to myopenssl directory
make test
make install_fips
	creates
	/home/kgold/myopenssl/lib/ossl-modules/fips.so
	/home/kgold/myopenssl/fipsmodule.cnf

openssl.cnf
	add
		.pragma includedir:/home/myopenssl/
	uncomment
		.include fipsmodule.cnf
	comment
		#default = default_sect
	add
		base = default_sect
		fips = fips_sect
	in default_sect, uncomment
		activate = 1

fipsmodule.cnf
	add
		module = /home/myopenssl/lib/ossl-modules/fips.so

LNFLAGS += -L/home/myopenssl/lib -Wl,-rpath=/home/myopenssl/lib -lcrypto

Test with
	openssl list -providers

Providers:
   base
     name: OpenSSL Base Provider
     version: 3.6.1
     status: active
   fips
     name: OpenSSL FIPS Provider
     version: 3.6.1
     status: active


-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/10le5va%248bh%241%40ciao.gmane.io.