FIPS_CONFIG(5SSL)

📦
version 4.0.3 · 13 versions
, in ubuntu stonking

💖 fips_config — the OpenSSL FIPS configuration glow-up 💖

okay bestie, so this is fips_config, a whole entire manual page (section 5SSL, the config-file girlies) about the special little config file that holds all the FIPS module tea. no cap.

🌸 NAME 🌸

fips_config — OpenSSL FIPS configuration. that's the whole vibe. iconic, brief, perfect.

✨ DESCRIPTION ✨

So here's the deal. There's a separate configuration file, and it uses the OpenSSL config(5) syntax — you know, the same syntax as the regular config files, she's just living in her own file. And what does she hold? The info about the FIPS module. Specifically: a digest of the shared library file, plus status about the self-testing. 🔥

And this data? The module itself uses it automatically, for two purposes:

  • Run the startup FIPS self-test known answer tests (KATS). This is normally done once, at installation time, but it may also be set up to run each time the module is used.
  • Verify the module's checksum. And this one happens each time the module is used. every. single. time. she's thorough like that 💅

This file is generated by the openssl-fipsinstall(1) program, and it's used internally by the FIPS module during its initialization. so basically, don't hand-craft it unless you know what you're doing. 🫶

The following options are supported. They should all appear in a section whose name is identified by the fips option in the providers section, as described in "Provider Configuration Module" in config(5). (iykyk)

  • activate — if present, the module is activated. The value you assign to this name? doesn't matter, she's not significant. literally any value, she just needs to exist. ✨
  • conditional-errors — so the FIPS module normally enters an internal error mode if any self test fails. Once this error mode is active, no services or cryptographic algorithms are accessible from this point on. 💀 Continuous tests are a subset of the self tests (e.g., a key pair test during key generation, or the CRNG output test). Setting this value to 0 allows the error mode to not be triggered if any continuous test fails. The default value of 1 will trigger the error mode. Regardless of the value, the operation (e.g., key generation) that called the continuous test will return an error code if its continuous test fails. The operation may then be retried if the error mode has not been triggered. so like, 0 is the "let me try again bestie" setting, ngl.
  • defer-tests — if set to 1, the module will not run the self tests during initialization. Instead, the self tests will be run on demand when a particular algorithm is used. The default value of 0 runs the self tests during initialization. procrastination but make it cryptography 🌈
  • module-mac — the calculated MAC of the FIPS provider file.
  • install-version — a version number for the fips install process. Should be 1.
  • install-status — 🚨 This field is deprecated and is no longer used.
  • install-mac — 🚨 This field is deprecated and is no longer used.

🦋 FIPS indicator options 🦋

The following FIPS configuration options indicate if run-time checks related to enforcement of FIPS security parameters such as minimum security strength of keys and approved curve names are used. A value of '1' will perform the checks, otherwise if the value is '0' the checks are not performed and FIPS compliance must be done by procedures documented in the relevant Security Policy.

See "OPTIONS" in openssl-fipsinstall(1) for further information related to these options. (she's the source of truth, bestie, go read her too 💜)

For example:

 [fips_sect]
 activate = 1
 install-version = 1
 conditional-errors = 1
 security-checks = 1
 module-mac = 41:D0:FA:C2:5D:41:75:CD:7D:C3:90:55:6F:A4:DC
 install-mac = FE:10:13:5A:D3:B4:C7:82:1B:1E:17:4C:AC:84:0C
 install-status = INSTALL_SELF_TEST_KATS_RUN

🎀 NOTES 🎀

When using the FIPS provider, it is recommended that the config_diagnostics option is enabled to prevent accidental use of non-FIPS validated algorithms via broken or mistaken configuration. See config(5). like, turn it on bestie, she's your seatbelt 🫶

👑 SEE ALSO 👑

config(5), openssl-fipsinstall(1) — go give them a read, they're the supporting cast and they ate 💅

🌈 HISTORY 🌈

This functionality was added in OpenSSL 3.0. so she's not ancient, she's just very established. main character since 3.0 ✨

Copyright 2019-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page, no skips, no summaries, every single option present and accounted for 🧚 and for the sign-off: this is from OpenSSL 4.0.3, dated 2026-09-29 — and the page itself lives under the FIPS_CONFIG(5SSL) name. slay, bye bestie! 💖🎀🦋

📦 where this page comes from