OpenSSL FIPS Compliance Guide

# /etc/ssl/openssl.cnf (or custom location)

openssl_conf = openssl_init

[openssl_init]
providers = provider_sect
alg_section = algorithm_sect

[provider_sect]
fips = fips_sect
base = base_sect
# NOTE: default provider intentionally omitted for FIPS-only mode

[fips_sect]
activate = 1
# Path to FIPS module - verify this matches your installation
module = /usr/lib64/ossl-modules/fips.so

[base_sect]
activate = 1
# Base provider needed for encoders/decoders, not crypto

[algorithm_sect]
default_properties = fips=yes

#include <openssl/provider.h>
#include <openssl/evp.h>

int enable_fips_mode(void) {
    OSSL_PROVIDER *fips = NULL;
    OSSL_PROVIDER *base = NULL;
    
    /* Load FIPS provider */
    fips = OSSL_PROVIDER_load(NULL, "fips");
    if (fips == NULL) {
        fprintf(stderr, "Failed to load FIPS provider\n");
        return 0;
    }
    
    /* Load base provider (for encoding, not crypto) */
    base = OSSL_PROVIDER_load(NULL, "base");
    if (base == NULL) {
        fprintf(stderr, "Failed to load base provider\n");
        OSSL_PROVIDER_unload(fips);
        return 0;
    }
    
    /* Set FIPS as the default property for all algorithms */
    if (!EVP_default_properties_enable_fips(NULL, 1)) {
        fprintf(stderr, "Failed to enable FIPS properties\n");
        return 0;
    }
    
    /* Verify FIPS provider is active */
    if (!EVP_default_properties_is_fips_enabled(NULL)) {
        fprintf(stderr, "FIPS mode not enabled\n");
        return 0;
    }
    
    printf("FIPS mode enabled successfully\n");
    return 1;
}

# Check if FIPS provider is available
openssl list -providers

# Expected output for FIPS-enabled system:
# Providers:
#   fips
#     name: OpenSSL FIPS Provider
#     version: 3.0.8
#     status: active
#   base
#     name: OpenSSL Base Provider
#     version: 3.0.8
#     status: active

# Test that non-FIPS algorithms fail
openssl md5 /dev/null
# Should fail with: "digital envelope routines:unsupported"

# Test that FIPS algorithms work
openssl sha256 /dev/null
# Should succeed

# Deploy standardized openssl.cnf via config management
# Ansible example:
- name: Deploy FIPS OpenSSL configuration
  template:
    src: openssl-fips.cnf.j2
    dest: /etc/ssl/openssl.cnf
    mode: '0644'
  notify: Verify FIPS mode

- name: Verify FIPS mode
  command: openssl list -providers
  register: fips_check
  failed_when: "'fips' not in fips_check.stdout"

# GitHub Actions example
- name: Verify FIPS Mode
  run: |
    # Verify FIPS provider is loaded
    openssl list -providers | grep -q "fips" || exit 1
    
    # Verify non-FIPS algorithms fail
    if openssl md5 /dev/null 2>/dev/null; then
      echo "ERROR: MD5 should be blocked in FIPS mode"
      exit 1
    fi
    
    echo "FIPS mode verified"

# Python example - verify FIPS at startup
import ssl
import sys

def verify_fips_mode():
    """Verify OpenSSL FIPS mode is active."""
    try:
        import hashlib
        hashlib.md5(b"test")
        print("WARNING: MD5 succeeded - FIPS may not be active")
        return False
    except ValueError as e:
        if "disabled for FIPS" in str(e).lower():
            print("FIPS mode verified")
            return True
    return False

if __name__ == "__main__":
    if not verify_fips_mode():
        sys.exit(1)

# Log FIPS status at application startup for audit trail
import logging
import ssl

logger = logging.getLogger(__name__)

def log_fips_status():
    """Log FIPS compliance status for audit purposes."""
    openssl_version = ssl.OPENSSL_VERSION
    
    # Log for audit trail
    logger.info(f"OpenSSL Version: {openssl_version}")
    logger.info(f"FIPS Mode: Active")  # After verification
    logger.info(f"FIPS Module: Certificate #XXXX")  # Your cert
    logger.info(f"Configuration: /etc/ssl/openssl.cnf")

# Dockerfile - pin OpenSSL and FIPS module versions
FROM ubuntu:22.04

# Pin exact OpenSSL version for FIPS compliance
ARG OPENSSL_VERSION=3.0.8
ARG FIPS_MODULE_VERSION=3.0.8

# Document for change management
LABEL fips.certificate="4282" \
      fips.openssl.version="${OPENSSL_VERSION}" \
      fips.module.version="${FIPS_MODULE_VERSION}"

# Install pinned version
RUN apt-get update && apt-get install -y \
    openssl=${OPENSSL_VERSION}-* \
    && rm -rf /var/lib/apt/lists/*

# Verify FIPS at build time
RUN openssl list -providers | grep -q fips