FIPS_CONFIG(5ossl)

📦
version 15.1 · 3 versions
, in freebsd 15.1

💅 NAME 💅

okay so bestie, this is fips_config — the OpenSSL FIPS configuration page, i.e. the manual for FIPS_CONFIG(5ossl). she's the one who handles the ~secure~ config file energy. 🎀

✨ DESCRIPTION ✨

so there's this whole separate configuration file, right — and it uses the OpenSSL config(5) syntax — and its whole job is holding info about the FIPS module. like, it literally carries a digest of the shared library file, plus status about the self-testing. and the module itself just... uses that data automatically for two things, no cap:

  • Run the startup FIPS self-test known answer tests (KATS). this is normally done once, at installation time, but it can also be set up to run each time the module is used.
  • Verify the module's checksum. this one happens each time the module is used. every single time. she's thorough. 💅

this file is generated by the openssl-fipsinstall(1) program, and it's used internally by the FIPS module during its initialization.

these are the options she supports — and yup, they should all appear in a section whose name is identified by the fips option in the providers section, as described in "Provider Configuration Module" in config(5). periodt.

  • activate — if present, the module is activated. the value you assign to this name is not significant, bestie, so don't stress about it.
  • conditional-errors — okay so the FIPS module normally enters an internal error mode if any self test fails. once that error mode is active, no services or cryptographic algorithms are accessible from that point on. continuous tests are a subset of the self tests (e.g., a key pair test during key generation, or the CRNG output test). setting this value to 0 allows the error mode to not be triggered if any continuous test fails. the default value of 1 will trigger the error mode. and regardless of the value, the operation (e.g., key generation) that called the continuous test will return an error code if its continuous test fails. the operation may then be retried if the error mode has not been triggered. 😭
  • module-mac — the calculated MAC of the FIPS provider file. that's it. that's the whole vibe.
  • install-version — a version number for the fips install process. should be 1.
  • install-status — this field is deprecated and is no longer used. 🫠
  • install-mac — this field is deprecated and is no longer used. also retired. also resting.

🌸 FIPS indicator options 🌸

so these FIPS configuration options indicate whether run-time checks related to enforcement of FIPS security parameters — stuff like minimum security strength of keys and approved curve names — are actually used. a value of '1' will perform the checks; otherwise, if the value is '0', the checks are not performed and FIPS compliance must be done by procedures documented in the relevant Security Policy. like, that's on you at that point, bestie. ⚠️

see "OPTIONS" in openssl-fipsinstall(1) for further information related to these options.

for example, here's the moment, the serve, the whole look:

 [fips_sect]
 activate = 1
 install-version = 1
 conditional-errors = 1
 security-checks = 1
 module-mac = 41:D0:FA:C2:5D:41:75:CD:7D:C3:90:55:6F:A4:DC
 install-mac = FE:10:13:5A:D3:B4:C7:82:1B:1E:17:4C:AC:84:0C
 install-status = INSTALL_SELF_TEST_KATS_RUN

she ate, honestly. 🔥

🦋 NOTES 🦋

when using the FIPS provider, it is recommended that the config_diagnostics option is enabled to prevent accidental use of non-FIPS validated algorithms via broken or mistaken configuration. see config(5).

bestie please turn on config_diagnostics. broken or mistaken config sneaking non-FIPS validated algorithms in is not the cute kind of plot twist. 💀

🌈 SEE ALSO 🌈

config(5) openssl-fipsinstall(1)

👑 HISTORY 👑

this functionality was added in OpenSSL 3.0.

Copyright 2019-2025 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

so yeah, that's the whole page, mwah 💋 — this was FIPS_CONFIG(5ossl) from OpenSSL 3.5.6, dated 2026-04-07. go forth and configure responsibly, bestie 🫶✨

📦 where this page comes from