<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">One way to do what you want is with two config file, and and in the first line of your main() function, add:<div class=""><br class=""></div><div class="">putenv(“OPENSSL_CONF=/path/to/your/conf”)</div><div class=""><br class=""></div><div class="">depending on whether you want to run in FIPS mode or not. Of course, this only works if FIPS is needed application wide, not on a per connection basis.</div><div class=""><br class=""></div><div class="">If running in FIPS mode, I would also call:</div><div class=""><br class=""></div><div class="">EVP_set_default_properties(NULL, “fips=yes”);</div><div class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Oct 23, 2021, at 9:58 AM, Jason Schultz <<a href="mailto:jetson23@hotmail.com" class="">jetson23@hotmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta charset="UTF-8" class=""><div style="font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;" class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">Quick aside: I know the 3.0 FIPS module is not "approved" yet, I'm just trying to get my application updates done in advance.</div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><br class=""></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">I’m porting an application from OpenSSL 1.1.1, which was originally written for OpenSSL 1.0.2, to OpenSSL 3.0. Going to 3.0, I need to incorporate FIPS usage. My Linux application basically is told if its user wants to use FIPS or not. We don’t use the cryptographic APIs (EVP_*), we just need to create an SSL_CTX, and SSL objects created with SSL_new() based on this SSL_CTX, which will then call SSL_read(), SSL_write(), etc. The application won’t “fetch” any algorithms. So my focus can been on Section 7.7 of the Wiki:<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><a href="https://wiki.openssl.org/index.php/OpenSSL_3.0#Using_the_FIPS_module_in_SSL.2FTLS" class="">https://wiki.openssl.org/index.php/OpenSSL_3.0#Using_the_FIPS_module_in_SSL.2FTLS</a><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">Based on if FIPS is on or off, I will use the replacement for SSL_CTX_new() and call SSL_CTX_new_ex() either something like this:<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">ctx = SSL_CTX_new_ex(non_fips_libctx, NULL, TLS_method());<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">or this:<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">ctx = SSL_CTX_new_ex(fips_libctx, NULL, TLS_method());<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">Depending on if the users does not want FIPS, or wants FIPS, respectively.<span class="Apple-converted-space"> </span><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">Based on that and what Section 7.7 tells me, I know I need:<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><ol style="margin-bottom: 0in;" class=""><li class="">A non-default library context with the FIPS provider loaded (called fips_libctx), and<o:p class=""> </o:p></li><li class="">A non-default library context with the default provider loaded (called non_fips_libctx)<o:p class=""> </o:p></li></ol><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">I know that I don’t want all applications using OpenSSL to use the FIPS module by default, so I’m just trying to configure mine correctly, using the APIs (and possibly config files). I also obviously don’t want to make my application use the FIPS module only.<span class="Apple-converted-space"> </span><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">Given all of the above I’m confused on how to set up #1 and #2. It seems like I need to use a combination of configuration files and programmatically calling APIs in my application. In the Wiki and the fips_module man page there is a section called “Programmatically loading the FIPS module (nondefault library context)”. I’m pretty sure this is what I want. The code example says it “assumes the existence of a config file called openssl-fips.cnf that automatically loads and configures the FIPS and base providers.”<span class="Apple-converted-space"> </span><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">The .cnf files that I have after the (FIPS) install of OpenSSL 3.0 are in /usr/local/ssl/: openssl.cnf and fipsmodule.cnf.<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">I guess the first thing is I’m confused on if the “openssl-fips.cnf” file referred to in the example is in addition to the two files above, or a replacement for one of them, and also what the contents of it need to be.<span class="Apple-converted-space"> </span><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">I had already made changes to the openssl.cnf file for FIPS (described in earlier sections of the Wiki):<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New";" class=""># For FIPS<o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New";" class=""># Optionally include a file that is generated by the OpenSSL fipsinstall<o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New";" class=""># application. This file contains configuration data required by the OpenSSL<o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New";" class=""># fips provider. It contains a named section e.g. [fips_sect] which is<o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New";" class=""># referenced from the [provider_sect] below.<o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New";" class=""># Refer to the OpenSSL security policy for more information.<o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New"; background-color: yellow;" class="">.include<span class="Apple-converted-space"> </span><b class="">/usr/local/ssl/fipsmodule.cnf</b></span><b class=""><span style="font-size: 11pt; font-family: "Courier New";" class=""><span class=""> <span class="Apple-converted-space"> </span></span></span></b><b class=""><span style="font-size: 11pt; font-family: Wingdings;" class=""><span class="">ß</span></span></b><b class=""><span style="font-size: 11pt; font-family: "Courier New";" class=""><span class="Apple-converted-space"> </span></span></b><span style="font-size: 11pt; font-family: "Courier New";" class="">uncommented</span><span style="font-size: 11pt; font-family: "Courier New";" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New";" class=""> <o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New";" class="">[openssl_init]<o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New";" class="">providers = provider_sect<o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New";" class=""> <o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New";" class=""># List of providers to load<o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New";" class="">[provider_sect]<o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New";" class="">default = default_sect<o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New";" class=""># The fips section name should match the section name inside the<o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New";" class=""># included fipsmodule.cnf.<o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New"; background-color: yellow;" class="">fips = fips_sect</span><span style="font-size: 11pt; font-family: "Courier New";" class=""><span class=""> <span class="Apple-converted-space"> </span></span></span><span style="font-size: 11pt; font-family: Wingdings;" class=""><span class="">ß</span></span><span style="font-size: 11pt; font-family: "Courier New";" class=""><span class="Apple-converted-space"> </span>uncommented<o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New";" class=""> <o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New";" class=""># If no providers are activated explicitly, the default one is activated implicitly.<o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New";" class=""># See man 7 OSSL_PROVIDER-default for more details.<o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New";" class="">#<o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New";" class=""># If you add a section explicitly activating any other provider(s), you most<o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New";" class=""># probably need to explicitly activate the default provider, otherwise it<o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New";" class=""># becomes unavailable in openssl.<span class=""> <span class="Apple-converted-space"> </span></span>As a consequence applications depending on<o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New";" class=""># OpenSSL may not work correctly which could lead to significant system<o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New";" class=""># problems including inability to remotely access the system.<o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New";" class="">[default_sect]<o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New"; background-color: yellow;" class="">activate = 1</span><span style="font-size: 11pt; font-family: "Courier New";" class=""><span class=""> <span class="Apple-converted-space"> </span></span></span><span style="font-size: 11pt; font-family: Wingdings;" class=""><span class="">ß</span></span><span style="font-size: 11pt; font-family: "Courier New";" class=""><span class="Apple-converted-space"> </span>uncommented<o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New";" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">I did this to make sure the FIPS provider was available and make sure the default provider was activated.<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">I also changed the fipsmodule.cnf file to comment out the activate = 1 line:<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New";" class="">[fips_sect]<o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New"; background-color: yellow;" class=""># activate = 1</span><span style="font-size: 11pt; font-family: "Courier New";" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New";" class="">conditional-errors = 1<o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New";" class="">security-checks = 1<o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span style="font-size: 11pt; font-family: "Courier New";" class="">module-mac = E4:0D:C8:C3:1E:DB:2B:30:E6:F2:49:7B:F5:BD:10:5C:9A:2B:CC:C1:33:49:31:B5:C5:AF:50:AB:82:1E:AE:C9<o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">That was from the “Programmatically loading the FIPS module (default library context)” section, so I’m wondering if this was a mistake.<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">But currently, with the configs files as described above, my application is loading both providers:<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span class=""> <span class="Apple-converted-space"> </span></span>fipsp = OSSL_PROVIDER_load(NULL, "fips");<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span class=""> <span class="Apple-converted-space"> </span></span>if (fipsp == NULL)<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span class=""> <span class="Apple-converted-space"> </span></span>{<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span class=""> <span class="Apple-converted-space"> </span></span>/* error handling */<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span class=""> <span class="Apple-converted-space"> </span></span>}<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span class=""> <span class="Apple-converted-space"> </span></span><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span class=""> <span class="Apple-converted-space"> </span></span>defp = OSSL_PROVIDER_load(NULL, "default");<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span class=""> <span class="Apple-converted-space"> </span></span>if (defp == NULL)<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span class=""> <span class="Apple-converted-space"> </span></span>{<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span class=""> <span class="Apple-converted-space"> </span></span>/* error handling */<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span class=""> <span class="Apple-converted-space"> </span></span>}<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">And then creating two library contexts:<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span class=""> <span class="Apple-converted-space"> </span></span>fips_libctx = OSSL_LIB_CTX_new();<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span class=""> <span class="Apple-converted-space"> </span></span>non_fips_libctx = OSSL_LIB_CTX_new();<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">Which are later used to create SSL_CTX’s as needed:<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span class=""> <span class="Apple-converted-space"> </span></span>if (user does not want fips)<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span class=""> <span class="Apple-converted-space"> </span></span>{<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span class=""> <span class="Apple-converted-space"> </span></span>ctx = SSL_CTX_new_ex(non_fips_libctx, NULL, TLS_method());<span class="Apple-converted-space"> </span><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span class=""> <span class="Apple-converted-space"> </span></span>}<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span class=""> <span class="Apple-converted-space"> </span></span>else (user wants fips)<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span class=""> <span class="Apple-converted-space"> </span></span>{<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span class=""> <span class="Apple-converted-space"> </span></span>ctx = SSL_CTX_new_ex(fips_libctx, NULL, TLS_method());<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><span class=""> <span class="Apple-converted-space"> </span></span>}<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">But I think the 2<sup class="">nd</sup><span class="Apple-converted-space"> </span>to last step is probably creating two library contexts, both using fips because of my changes to the default configuration file. (more on my changes to the default file later) Looking at section 7.5 of the Wiki, I’m thinking I need to create a file called openssl-fips.cnf with the contents something like(or maybe a minimum of):<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">[fips_sect]<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">activate = 1<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">conditional-errors = 1<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">security-checks = 1<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">module-mac = E4:0D:C8:C3:1E:DB:2B:30:E6:F2:49:7B:F5:BD:10:5C:9A:2B:CC:C1:33:49:31:B5:C5:AF:50:AB:82:1E:AE:C9<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">[base_sect]<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">activate = 1<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">Then before creating SSL_CTX’s and after the OSSL_LIB_CTX() calls, I need to call:<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">OSSL_LIB_CTX_load_config(fips_libctx, “openssl-fips.cnf”);<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">Which will get the FIPS and base providers in the fips_libctx. The non_fips_libctx will use the default config file and have the default provider, which is what I want.<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">Also, it seems like I need to call:<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">defctxnull = OSSL_PROVIDER_load(NULL, “null”);<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">Which is to “prevent anything from using the default library context”?<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">Also, I probably need to revert my changes to the default config file to not activate additional providers, which means only the default one will be activate implicitly. Then the non_fips_libctx = OSSL_LIB_CTX_new(); line will set up the default provider in non_fips_libctx.<o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">I’m hoping someone can point me in the right direction, because the other problem is that I’m not sure how to validate what I’ve done is correct. As in, how do I know fips_libctx is actually “FIPS” compliant, and/or the SSL_CTX’s I create are “FIPS”. I realize there are probably several ways to do this, but I’m looking to isolate my application only this way, and not affect any other applications on the system.<span class="Apple-converted-space"> </span><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class="">Thanks in advance.<span class="Apple-converted-space"> </span><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class=""><br class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: "Times New Roman", serif;" class=""><o:p class="">Jason</o:p></div></div></div></blockquote></div><br class=""></div></body></html>