Re: How to test a build of the FIPS provider

On Wed, Jan 28, 2026 at 06:26:32PM -0500, Ken Goldman wrote:

> For the record, here are working instructions, creating
> a fips build in myopenssl:
> 
> ./config -shared --prefix=/home/kgold/myopenssl --libdir=lib
>   --openssldir=/home/kgold/myopenssl -Wl,-rpath,$HOME/myopenssl/lib --debug zlib enable-fips

So far, so good, but you can also add:

    $ grep -v '#' <<-\EOF > Configurations/99-test.conf
	# Leading <TAB>s below to go with the "-\EOF" above
        my %targets = (
            "kgold" => {
                inherit_from     => [ "linux-x86_64" ],
                shlib_variant    => "-test",
		shared_ldflag    => "-Wl,-rpath,$ENV{'HOME'}/myopenssl/lib",
		module_ldflags   => "",
		bin_lflags	 => "-Wl,-rpath,$ENV{'HOME'}/myopenssl/lib",
            },
	EOF

And then set "kgold" as the last "config" (or "Configure") argument.

    ./config -shared --debug --prefix=/home/kgold/myopenssl \
	--libdir=lib --openssldir=/home/kgold/myopenssl \
	--debug zlib enable-fips kgold

This produces a "shlib_variant" with "-test" in the SONAMEs and "_TEST"
in the symbol names, and goes the extra mile to not add an RPATH to the
othewise self-contained FIPS module.  (Apologies about the rather
haphazard naming of the various LD flag variables, there are even it
seems some inconsistencies in the names used between Unix, Windows and
VMS, the above workds for Unix).

> openssl.cnf
> 	add
> 		.pragma includedir:/home/myopenssl/
> 	uncomment
> 		.include fipsmodule.cnf
> 	comment
> 		#default = default_sect
> 	add
> 		base = default_sect
> 		fips = fips_sect
> 	in default_sect, uncomment
> 		activate = 1

This looks good for default base + fips activation.

> fipsmodule.cnf
> 	add
> 	    module = /home/myopenssl/lib/ossl-modules/fips.so

Yes, this obviates the need for an explicit OPENSSL_MODULES
environment variable, and loads this particular module even
in applications that have a different default MODULESDIR
("openssl version -m").

> LNFLAGS += -L/home/myopenssl/lib -Wl,-rpath=/home/myopenssl/lib -lcrypto

Sounds like you're linking your application against this OpenSSL
runtime, but that's not required.  Given your choice of "openssldir",,
It suffixes to just:

    export OPENSSL_CONF=/home/myopenssl/openssl.cnf

and link the tests against the default system OpenSSL library,
but you can of course link against the custom runtime if you
wish.

-- 
    Viktor.  🇺🇦 Слава Україні!

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/aXr_bPUK5c1vqrin%40chardros.imrryr.org.