|
Thanks for all of the help so far. Unfortunately, I'm still struggling with this. There could be a number of issues, starting with the installation of OpenSSL. I basically followed the documentation and did the following:
./Configure enable-fips make make test make install
The "make test" actually fails, but I did not troubleshoot as it seems like a lot of systems have issues here. But I know the .so produced when I build my application is linking to the correct OpenSSL libraries (libssl.so.3 and libcrypto.so.3). Checking
the OpenSSL version shows 3.0.
I've tried a number of combinations trying to make this work, starting with the code from Dr. Paul Dale in a previous message:
fips_libctx = OSSL_LIB_CTX_new();
if (!fips_libctx)
// error handling
non_fips_libctx = OSSL_LIB_CTX_new();
if (!non_fips_libctx)
// error handling
fipsp = OSSL_PROVIDER_load(fips_libctx, "fips");
if (fipsp == NULL)
{
/* error handling */
}
basep = OSSL_PROVIDER_load(fips_libctx, "base");
if (basep == NULL)
{
/* error handling */
}
defp = OSSL_PROVIDER_load(non_fips_libctx, "default");
if (defp == NULL)
{
/* error handling */
}
/* Disallow falling back to the default library context */
nullp = OSSL_PROVIDER_load(NULL, "null");
if (nullp == NULL)
{
/*error handling */
}
With the code like the above, the OSSL_PROVIDER_load() calls fails for fips. If I try to use the fips_libctx in SSL_CTX_new_ex(), it fails and returns NULL, which is probably expected given the fips provider didn't load.
At that point, I wasn't sure if my application was using the (correct) config file in /usr/local/ssl/. I don't have any environment variables set up, and would prefer not to have to set any to get this to work. So I changed the provider load for FIPS
to use OSSL_LIB_CTX_load_config():
if (!OSSL_LIB_CTX_load_config(fips_libctx, "/usr/local/ssl/openssl-fips.cnf"))
// error handling
This seems to work load the provider; however, there are two separate problems at this point. If FIPS is enabled by my application creating the SSL_CTX with the FIPS library context fails, returning NULL.
If FIPS is turned OFF by my application, creating an SSL_CTX with the non_fips_libctx
is successful, but later calling X509_get_pubkey() returns NULL, implying maybe something is wrong with the non_fips_libctx as well.
I've tried other combinations, but at this point I'm just guessing. Is there anything obvious I could be missing and I should be checking?
Thanks,
Jason
From: Dr Paul Dale <pauli@xxxxxxxxxxx>
Sent: Monday, October 25, 2021 9:37 PM To: Jason Schultz <jetson23@xxxxxxxxxxx>; openssl-users@xxxxxxxxxxx <openssl-users@xxxxxxxxxxx> Subject: Re: OpenSSL 3.0 FIPS questions It was meant for the second method only. The first method is using different library contexts to distinguish FIPS algorithms. Using the properties in addition is harmless and might prevent a future mistake that breaks compliance.
Pauli On 26/10/21 4:46 am, Jason Schultz wrote:
|
