FIPS_CONFIG(5ossl)

📦
version 3.5.9 · 8 versions
, in alpine 3.23, alpine 3.24

💅 FIPS_CONFIG 💅

okay bestie, so this is fips_config — the OpenSSL FIPS configuration page, and honestly? it's giving "the most important file you've never opened." let's get into it 🫶

✨ NAME ✨

fips_config — OpenSSL FIPS configuration. that's it, that's the vibe. 🎀

🌸 SYNOPSIS 🌸

it's a config file, babe — so the "synopsis" is literally you opening it and reading it. no flags to memorize here, just vibes and key-value pairs. 💅

🦋 DESCRIPTION 🦋

So. There's this separate configuration file — it uses the OpenSSL config(5) syntax — and its whole job is holding info about the FIPS module. Like, a little diary for your module. 📓

What's inside it:

  • a digest of the shared library file
  • status about the self-testing

and the module itself uses this data automatically for two things:

  • Run the startup FIPS self-test known answer tests (KATS). this is normally done once, at installation time, but may also be set up to run each time the module is used. cozy.
  • Verify the module's checksum. this one happens each time the module is used. every single time. no exceptions, no skips. 👑

This file is generated by the openssl-fipsinstall(1) program, and used internally by the FIPS module during its initialization. so like, you don't hand-write it for funsies (though you can look at it 👀).

The following options are supported. They should all appear in a section whose name is identified by the fips option in the providers section, as described in "Provider Configuration Module" in config(5). iykyk. ✨

  • activate — if present, the module is activated. the value you assign to this name is not significant — put 1, put yes, put your star sign, doesn't matter, it's the presence that counts 💖
  • conditional-errors — okay so the FIPS module normally enters an internal error mode if any self test fails. once this error mode is active, no services or cryptographic algorithms are accessible from this point on. gone. locked out. 😭 Continuous tests are a subset of the self tests (e.g., a key pair test during key generation, or the CRNG output test). setting this value to 0 allows the error mode to not be triggered if any continuous test fails. the default value of 1 will trigger the error mode. regardless of the value, the operation (e.g., key generation) that called the continuous test will return an error code if its continuous test fails. the operation may then be retried if the error mode has not been triggered. so like, 0 is "don't nuke the whole module," not "pretend the failure didn't happen." 💀
  • module-mac — the calculated MAC of the FIPS provider file. the checksum, bestie.
  • install-version — a version number for the fips install process. should be 1.
  • install-status — this field is deprecated and is no longer used. it's just here being nostalgic 🙈
  • install-mac — this field is deprecated and is no longer used. also just vibing in the file 🫠

👑 FIPS indicator options 👑

The following FIPS configuration options indicate if run-time checks related to enforcement of FIPS security parameters — such as minimum security strength of keys and approved curve names — are used.

  • a value of '1' → the checks are performed
  • a value of '0' → the checks are not performed, and FIPS compliance must be done by procedures documented in the relevant Security Policy

See "OPTIONS" in openssl-fipsinstall(1) for further information related to these options. (that's your homework, bestie 📚)

For example ✨ (and yes, module-mac and install-mac here are literally that short — that's the example, don't come for me):

 [fips_sect]
 activate = 1
 install-version = 1
 conditional-errors = 1
 security-checks = 1
 module-mac = 41:D0:FA:C2:5D:41:75:CD:7D:C3:90:55:6F:A4:DC
 install-mac = FE:10:13:5A:D3:B4:C7:82:1B:1E:17:4C:AC:84:0C
 install-status = INSTALL_SELF_TEST_KATS_RUN

(the install-mac and install-status lines are, as established, deprecated — but they're in the example, so they stay. history! 🎻)

💜 NOTES 💜

When using the FIPS provider, it is recommended that the config_diagnostics option is enabled, to prevent accidental use of non-FIPS validated algorithms via broken or mistaken configuration.

fr fr bestie, turn config_diagnostics on. one typo in your config and you're accidentally running non-validated algorithms and nobody wants that conversation with the auditor. 😭 see config(5).

🌈 SEE ALSO 🌈

config(5) · openssl-fipsinstall(1)

⭐ HISTORY ⭐

This functionality was added in OpenSSL 3.0. vintage-ish. 💅

Copyright 2019-2025 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, bestie — go forth and configure your FIPS module responsibly 🧚

mwah 💋 — this was FIPS_CONFIG, from the OpenSSL 3.5.9 era, dated 2026-09-29. stay validated ✨

📦 where this page comes from