Clarification regarding fips.cnf file generation

[AshishSingh08]

Hi,

I have a use case where we currently ship both the OpenSSL binary and the FIPS provider module (fips.so). During installation, we use the openssl fipsinstall command to generate the fips.cnf configuration file on the target host.

We are now planning to remove the separate OpenSSL binary and instead use the existing OpenSSL statically linked into our application. However, we will continue to ship the fips.so FIPS provider module on the host.

Since the standalone openssl binary will no longer be available, we would like to generate the fips.cnf file programmatically from our C++ application using the statically linked OpenSSL APIs, for example, APIs exposed through: (openssl/core_names.h, openssl/crypto.h, openssl/evp.h, openssl/params.h, openssl/provider.h, and other relevant OpenSSL APIs.)

I found some related thread: here but would like to clarify the following:

1. Would generating the fips.cnf file programmatically using the statically linked OpenSSL library be considered FIPS-compliant ?
2. Would this approach violate any OpenSSL/FIPS security policies or requirements? Or can we use this approach while maintaining FIPS compliance?
3. Is there an officially supported OpenSSL API or recommended approach for programmatically performing the same operations as openssl fipsinstall—including the FIPS provider self-tests, module integrity verification, and generation of the FIPS configuration data—without shipping the standalone openssl executable?

[slontis]

The answer depends on your FIPS provider version..

Older fips.cnf files may contain the following lines:
install-status = INSTALL_SELF_TEST_KATS_RUN
install-mac = FE:10:13:5A:D3:B4:C7:82:1B:1E:17:4C:AC:84:0C

The FIPS requirement for FIPS 140-2 was that the power on self tests run at least once, and the fips.cnf had a parameter in it determining in it had run once or not. This has to run on the target machine, so just copying this .cnf file across from another machine would not be allowed, If the cnf is set up to always run self tests on power up then you could copy the file.
(Provided the module-mac is the same).
i.e remove the install-status and install-mac lines manually.

In FIPS 140-3 running once is no longer allowed, so you could just copy the .cnf for this case . The fipsinstall should not add the install-status line. For OpenSSL 3.1+ fipsinstall uses -self_test_onload by default..

[nhorman]

The answer to questions 1 and 2 are "you need to ask your validation lab". The openssl security policy expressly states that the fipsinstall command must be used to generate the fipsmodule.cnf file. It would be a determination for your lab to make as to weather or not re-implementing that command within your application is sufficiently non-intrusive to avoid any needed retesting.

As to question (3), assuming the answer from your lab to (1) and (2) is "sure, thats ok", is found in the fipsinstall_main function in the apps folder of your source tree. That function contains the needed operations to implement what the fipsinstall command does.