<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div style="margin: 0px; font-size: 15px; font-family: Helvetica, Arial, sans-serif, serif, EmojiFont; color: rgb(34, 34, 34); background-color: rgb(255, 255, 255)">
<p style="margin-top: 0px; margin-bottom: 0px; font-family: Helvetica, Arial, sans-serif; background-color: rgb(255, 255, 255)">
Hi Experts,</p>
<p style="margin-top: 0px; margin-bottom: 0px; font-family: Helvetica, Arial, sans-serif; background-color: rgb(255, 255, 255)">
<br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px; font-family: Helvetica, Arial, sans-serif; background-color: rgb(255, 255, 255)">
Looking for some assistance. I’ve compiled one of the App in FIPs mode and while running the App. I’m getting fingerprint mismatch error. I’ve followed the standard procedure to build a FIPS module using OpenSSL UserGuide 2.0. But not sure what part is missing.</p>
<p style="margin-top: 0px; margin-bottom: 0px; font-family: Helvetica, Arial, sans-serif; background-color: rgb(255, 255, 255)">
:~$ openssl version<br>
OpenSSL 1.0.2q-fips 20 Nov 2018</p>
<p style="margin-top: 0px; margin-bottom: 0px; font-family: Helvetica, Arial, sans-serif; background-color: rgb(255, 255, 255)">
<br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px; font-family: Helvetica, Arial, sans-serif; background-color: rgb(255, 255, 255)">
<strong style="font-weight: bold">:~$ (App version check Output)</strong></p>
<p style="margin-top: 0px; margin-bottom: 0px; font-family: Helvetica, Arial, sans-serif; background-color: rgb(255, 255, 255)">
<b><br>
</b><strong style="font-weight: bold">error initializing FIPS mode</strong><br>
<strong style="font-weight: bold">0:error:2D06B06F:FIPS routines:FIPS_check_incore_fingerprint:fingerprint does not match:fips.c:232:</strong></p>
<br>
<br>
I followed the standard procedure to build the FIPS module. If I try running Openssl commands via FIPS enabled it didn’t give me any errors:</div>
<p style="margin-top: 0px; margin-bottom: 0px; color: rgb(34, 34, 34); font-family: Helvetica, Arial, sans-serif; font-size: 15px; background-color: rgb(255, 255, 255)">
root@haproxyOpenSSLFIPS-02:/home/ubuntu# OPENSSL_FIPS=1 openssl md5 xyz.txt<br>
Error setting digest md5<br>
140197799200408:error:060A80A3:digital envelope routines:FIPS_DIGESTINIT:disabled for fips:fips_md.c:180:</p>
<p style="margin-top: 0px; margin-bottom: 0px; color: rgb(34, 34, 34); font-family: Helvetica, Arial, sans-serif; font-size: 15px; background-color: rgb(255, 255, 255)">
<br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px; color: rgb(34, 34, 34); font-family: Helvetica, Arial, sans-serif; font-size: 15px; background-color: rgb(255, 255, 255)">
But if I try via app it initialize to fail due to fingerprint error:<br>
I compiled the app build via following make command:</p>
<p style="margin-top: 0px; margin-bottom: 0px; color: rgb(34, 34, 34); font-family: Helvetica, Arial, sans-serif; font-size: 15px; background-color: rgb(255, 255, 255)">
make TARGET=linux2628 USE_PCRE=1 USE_OPENSSL=1 USE_ZLIB=1 SSL_INC=/usr/local/ssl/include SSL_LIB=/usr/local/ssl/lib/</p>
<p style="margin-top: 0px; margin-bottom: 0px; color: rgb(34, 34, 34); font-family: Helvetica, Arial, sans-serif; font-size: 15px; background-color: rgb(255, 255, 255)">
Where as FIPS module path is: /usr/local/ssl/fips-2.0</p>
<p style="margin-top: 0px; margin-bottom: 0px; color: rgb(34, 34, 34); font-family: Helvetica, Arial, sans-serif; font-size: 15px; background-color: rgb(255, 255, 255)">
I’m thinking may be issue is at the path end while using make for haproxy (as above ^) but not sure.</p>
<p style="margin-top: 0px; margin-bottom: 0px; color: rgb(34, 34, 34); font-family: Helvetica, Arial, sans-serif; font-size: 15px; background-color: rgb(255, 255, 255)">
Here is ldd haproxy result:</p>
<p style="margin-top: 0px; margin-bottom: 0px; color: rgb(34, 34, 34); font-family: Helvetica, Arial, sans-serif; font-size: 15px; background-color: rgb(255, 255, 255)">
root@haproxyOpenSSLFIPS-02:/home/ubuntu/haproxy-1.9.2# ldd haproxy<br>
linux-vdso.so.1 => (0x00007ffcd331c000)<br>
libcrypt.so.1 => /lib/x86_64-linux-gnu/libcrypt.so.1 (0x00007fa12fef2000)<br>
libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007fa12fcd8000)<br>
libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007fa12fabb000)<br>
librt.so.1 => /lib/x86_64-linux-gnu/librt.so.1 (0x00007fa12f8b3000)<br>
libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007fa12f6af000)<br>
libpcre.so.3 => /lib/x86_64-linux-gnu/libpcre.so.3 (0x00007fa12f43f000)<br>
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fa12f075000)<br>
/lib64/ld-linux-x86-64.so.2 (0x00007fa13012a000)</p>
<br>
</div>
</body>
</html>