Re: Custom Build Errors

--lAfRqaQfjW3sHlJb
Content-Type: text/plain; charset="UTF-8"
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Wed, Apr 15, 2026 at 09:12:44AM -0400, Mark Sigsbee wrote:

> I'm trying to build 3.6.0 with 3.2.1 for its approved FIPS library on
> Ubuntu 22.04. I know the default version of OpenSSL is 3.0 and basically
> leave it alone or the world will come to an end.

I think you mean "3.1.2" which is the latest FIPS-validated release.

The attached build script will construct (from source) a custom 3.6
build installed /opt/openssl/3.6, and a 3.1.2 "fips" module installed
/opt/openssl/3.1, with the 3.6 runtime configured to load the "3.1"
module and use only FIPS-approved algorithms.

It is of course assumed that you have all the necessary build
dependencies (compiler, required Perl modules, ...) installed.

This does not by itself make your deployment be FIPS-conformant, you
still need to read and the OpenSSL FIPS security policy and follow all
relevant guidelines.  My build is a demo, your deployment may need to
have appropriate adjustments

The source repo and build trees will be in the "openssl/" subdirectory
of whatever directory you're in when you execute the below "bash" shell
script.

Look carefully over the output to make sure all tests passed, the script
can be modified to abort on test failure, at your discretion.  This is
not a "production" deployment script, it is a proof-of-concept demo.

--=20
    Viktor.  =F0=9F=87=BA=F0=9F=87=A6 =D0=A1=D0=BB=D0=B0=D0=B2=D0=B0 =D0=A3=
=D0=BA=D1=80=D0=B0=D1=97=D0=BD=D1=96!

--=20
You received this message because you are subscribed to the Google Groups "=
openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msg=
id/openssl-users/afS75kJUHEXRMQOL%40chardros.imrryr.org.

--lAfRqaQfjW3sHlJb
Content-Type: application/x-sh
Content-Disposition: attachment; filename=fips.sh
Content-Transfer-Encoding: quoted-printable

#! /bin/bash=0A=0A# Create and download OpenSSL git repository=0Amkdir open=
ssl=0Acd openssl=0Agit init --bare openssl.git=0Acd openssl.git=0Agit remot=
e add origin https://github.com/openssl/openssl.git=0Agit fetch origin=0A=
=0A# Tags to build, adjust as needed, in particular whether to=0A# build th=
e FIPS validated 3.1.2, or a later version with=0A# additional bug fixes?=
=0A# #=0Agit worktree add -b openssl-3.6 ../openssl-3.6 openssl-3.6.2=0Agit=
 worktree add -b openssl-3.1 ../openssl-3.1 openssl-3.1.8=0A=0A# Build and =
test OpenSSL 3.6 for x86_64=0Acd ../openssl-3.6=0Acat > Configurations/99-c=
ustom.conf <<\EOF=0Amy %targets =3D (=0A    "linux-36" =3D> {=0A        inh=
erit_from     =3D> [ "linux-x86_64" ],=0A        shlib_variant    =3D> "-36=
",=0A        shared_ldflag    =3D> "-Wl,-rpath,\$(libdir)",=0A        modul=
e_ldflags   =3D> "",=0A        bin_lflags       =3D> "-Wl,-rpath,\$(libdir)=
",=0A    },=0A);=0AEOF=0A#=0A# Build and test OpenSSL 3.6=0A./Configure --p=
refix=3D/opt/openssl/3.6 linux-36=0Amake -j >/dev/null && echo OK=0Amake VF=
=3D1 test > test.log 2>&1 && echo OK=0A# Diagnostic output=0Atail test.log=
=0A=0A# Install custom OpenSSL 3.6 build into /opt/openssl/3.6=0Asudo bash =
-i <<\SUDO=0Amake install_sw install_ssldirs=0A#=0A# Extract libdir=3D... v=
alue=0A. <(sed -e 's/ .*//; /^$/q' openssl.pc)=0A=0A# Diagnostic output=0Ar=
eadelf -d "$libdir/libssl-36.so.3" | grep -E 'SONAME|RUNPATH|NEEDED'=0ASUDO=
=0A=0A# Build and test OpenSSL 3.1=0Acd ../openssl-3.1=0A./Configure enable=
-fips --prefix=3D/opt/openssl/3.1=0Amake -j >/dev/null=0Amake VF=3D1 test >=
 test.log 2>&1 && echo OK=0A# Diagnostic output=0Atail test.log=0A=0A# Inst=
all custom OpenSSL 3.1 FIPS runtime into /opt/openssl/3.1=0A# Configure Ope=
nSSL 3.6 to load the resulting FIPS provider and=0A# use "fips=3Dyes" as th=
e default EVP property query.=0A#=0Asudo bash -s <<\SUDO=0Amake install_fip=
s=0A=0A. <(sed -e 's/ .*//; /^$/q' openssl.pc)=0A=0A./util/wrap.pl ./apps/o=
penssl fipsinstall \=0A    -provider_name fips \=0A    -module "$libdir/oss=
l-modules/fips.so" \=0A    -out /opt/openssl/3.1/ssl/fipsmodule.cnf=0A=0A./=
util/wrap.pl ./apps/openssl fipsinstall -verify \=0A    -provider_name fips=
 \=0A    -module "$libdir/ossl-modules/fips.so" \=0A    -in /opt/openssl/3.=
1/ssl/fipsmodule.cnf=0A=0Aperl -lni -e '=0A    BEGIN { $libdir =3D shift; }=
=0A    print;=0A    if (m{^\[fips_sect\]}) {=0A        print "module =3D $l=
ibdir/ossl-modules/fips.so";=0A    }=0A' "$libdir" /opt/openssl/3.1/ssl/fip=
smodule.cnf=0A=0Acat > /opt/openssl/3.6/ssl/openssl.cnf <<\CNF=0A# Minimal =
demo openssl.conf, with FIPS from an OpenSSL 3.1 runtime=0A# installed in /=
opt/openssl/3.1.  You may want a more complete=0A# version with the below s=
ettings integrated into the relevant=0A# sections of that file.=0A#=0A# The=
 top unnamed (a.k.a."default") section:=0A#=0Aopenssl_conf =3D openssl_init=
=0A.include /opt/openssl/3.1/ssl/fipsmodule.cnf=0A=0A[openssl_init]=0Aprovi=
ders =3D provider_sect=0Aalg_section =3D evp_properties=0A=0A[evp_propertie=
s]=0Adefault_properties =3D "fips=3Dyes"=0A=0A[provider_sect]=0Afips =3D fi=
ps_sect=0Abase =3D activate=0Adefault =3D activate=0A=0A[activate]=0Aactiva=
te =3D 1=0ACNF=0ASUDO=0A
--lAfRqaQfjW3sHlJb--