<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="font-family: Calibri, sans-serif; font-size: 11pt;">Good Morning, </span><br>
</div>
<div dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; line-height:107%; font-size:11pt; font-family:Calibri,sans-serif">
<br>
</p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; line-height:107%; font-size:11pt; font-family:Calibri,sans-serif">
I am having an issue with the FIPS Module in an OpenSSL 3.0 build. Below are the build steps and the issues that I am seeing. Sorry for the length but I am trying to provide all of the relevant details in hopes that the solution to this issue will be easily
identifiable. </p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; line-height:107%; font-size:11pt; font-family:Calibri,sans-serif">
First, we are using ZLib 1.2.11. This is the default build for a windows machine so the tarball is extracted to the zlib directory and then we run “nmake -f win32/Makefile.msc”. </p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; line-height:107%; font-size:11pt; font-family:Calibri,sans-serif">
</p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; line-height:107%; font-size:11pt; font-family:Calibri,sans-serif">
Second, we are using OpenSSL 3.0.0. After extracting the tarball to the OpenSSL directory, we are running the following configuration: </p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; line-height:107%; font-size:11pt; font-family:Calibri,sans-serif; margin-left:.5in">
<i>perl Configure VC-WIN32 zlib-dynamic --with-zlib-include=<ZLIB_INCLUDE_DIR> --with-zlib-lib=<ZLIB_LIB_DIR> enable-fips enable-static-engine enable-capieng -DOPENSSL_CAPIENG_DIALOG </i></p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; line-height:107%; font-size:11pt; font-family:Calibri,sans-serif">
Followed by the default “nmake”. For the install step, I have tried both the default “nmake install” and I am currently using “nmake DESTDIR=<OPENSSL_INSTALL_DIR> install” to mimic the file structure after an install would have been done on the current machine. </p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; line-height:107%; font-size:11pt; font-family:Calibri,sans-serif">
</p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; line-height:107%; font-size:11pt; font-family:Calibri,sans-serif">
Once the install is completed, I am running the openssl fips-install command: </p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; line-height:107%; font-size:11pt; font-family:Calibri,sans-serif; margin-left:.5in">
<i>Openssl fipsinstall –out “<OPENSSL_INSTALL_DIR>\Program Files (x86)\Common Files\SSL\fipsmodule.cnf” –module “<OPENSSL_INSTALL_DIR>\Program Files (x86)\OpenSSL\lib\ossl-modules\fips.dll” </i></p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; line-height:107%; font-size:11pt; font-family:Calibri,sans-serif">
</p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; line-height:107%; font-size:11pt; font-family:Calibri,sans-serif">
At this point, all of the self-tests pass and the configure file is updated successfully. I also have to go into openssl.cnf and uncomment the following lines: </p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; line-height:107%; font-size:11pt; font-family:Calibri,sans-serif">
</p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; font-size:11pt; font-family:Calibri,sans-serif; margin-left:.5in">
<i># For FIPS </i></p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; font-size:11pt; font-family:Calibri,sans-serif; margin-left:.5in">
<i># Optionally include a file that is generated by the OpenSSL fipsinstall </i></p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; font-size:11pt; font-family:Calibri,sans-serif; margin-left:.5in">
<i># application. This file contains configuration data required by the OpenSSL </i></p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; font-size:11pt; font-family:Calibri,sans-serif; margin-left:.5in">
<i># fips provider. It contains a named section e.g. [fips_sect] which is </i></p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; font-size:11pt; font-family:Calibri,sans-serif; margin-left:.5in">
<i># referenced from the [provider_sect] below. </i></p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; font-size:11pt; font-family:Calibri,sans-serif; margin-left:.5in">
<i># Refer to the OpenSSL security policy for more information. </i></p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; font-size:11pt; font-family:Calibri,sans-serif; margin-left:.5in">
<i>.include fipsmodule.cnf </i></p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; font-size:11pt; font-family:Calibri,sans-serif; margin-left:.5in">
<i>… </i></p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; font-size:11pt; font-family:Calibri,sans-serif; margin-left:.5in">
<i>[provider_sect] </i></p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; font-size:11pt; font-family:Calibri,sans-serif; margin-left:.5in">
<i>default = default_sect </i></p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; font-size:11pt; font-family:Calibri,sans-serif; margin-left:.5in">
<i># The fips section name should match the section name inside the </i></p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; font-size:11pt; font-family:Calibri,sans-serif; margin-left:.5in">
<i># included fipsmodule.cnf. </i></p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; font-size:11pt; font-family:Calibri,sans-serif; margin-left:.5in">
<i>fips = fips_sect </i></p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; line-height:107%; font-size:11pt; font-family:Calibri,sans-serif">
</p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; line-height:107%; font-size:11pt; font-family:Calibri,sans-serif">
I am using this as part of stunnel so I am doing a stunnel build following this step. Once stunnel is built, I am running stunnel to create a connection but it fails on trying to initialize the FIPS module. Here is the error stack that I am getting: </p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; line-height:107%; font-size:11pt; font-family:Calibri,sans-serif">
</p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; line-height:107%; font-size:11pt; font-family:Calibri,sans-serif; margin-left:.5in">
<i>[!] error queue: crypto\provider_core.c:903: error:078C0105:common libcrypto routines::init fail </i></p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; line-height:107%; font-size:11pt; font-family:Calibri,sans-serif; margin-left:.5in">
<i>[!] error queue: providers\fips\fipsprov.c:706: error:1C8000D8:Provider routines::self test post failure </i></p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; line-height:107%; font-size:11pt; font-family:Calibri,sans-serif; margin-left:.5in">
<i>[!] error queue: providers\fips\self_test.c:387: error:1C8000E0:Provider routines::fips module entering error state </i></p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; line-height:107%; font-size:11pt; font-family:Calibri,sans-serif; margin-left:.5in">
<i>[!] FIPS PROVIDER: providers\fips\self_test.c:289: error:1C8000D5:Provider routines::missing config data </i></p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; line-height:107%; font-size:11pt; font-family:Calibri,sans-serif">
</p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; line-height:107%; font-size:11pt; font-family:Calibri,sans-serif">
Tracing through this, I have found that the check on line 288 in the self_test.c is failing because the module_checksum_data is null in the ST object. What I am failing to understand is why the module checksum keeps coming back null. To me, it seems that I
am overlooking a small step somewhere and can’t see it. Any help here would be greatly appreciated. </p>
<p class="x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin:0in 0in 8pt; line-height:107%; font-size:11pt; font-family:Calibri,sans-serif">
</p>
Thank you very much,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Bob Eshelman</div>
</div>
</body>
</html>