Bug 1985363

Summary: FIPS functionality in OpenSSL 3.0
Product: Red Hat Enterprise Linux 9 Reporter: Sahana Prasad <sahana>
Component: opensslAssignee: Sahana Prasad <sahana>
Status: CLOSED DUPLICATE QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: CentOS StreamCC: bstinson, dbelyavs, jwboyer, rharwood, szidek
Target Milestone: betaFlags: pm-rhel: mirror+
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-08-03 17:32:22 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Sahana Prasad 2021-07-23 13:56:05 UTC 
Working of FIPS mode in OpenSSL 3.0 deviates from the upstream FIPS behaviour.
Working of FIPS in upstream is described here:
https://github.com/openssl/openssl/blob/master/README-FIPS.md

RHEL-9

When is FIPS provider loaded by default?

1. If the kernel FIPS flag is set, then OpenSSL will automatically load the FIPS provider.
This means that no additional configuration is required to be set manually by the user.
No changes in openssl.cnf.
HMAC calculations will be done on fips.so.

2. If the kernel FIPS flag is not set, then OpenSSL will automatically load the DEFAULT provider.
(no config changes required as mentioned before)
However, if the user, wants to add other sections and load different providers through configuration
via openssl.cnf, this is fully permitted. It should be noted that this configuration will then take effect
and override what was configured by default. It is generally not recommended to customize openssl.cnf,unless it is absolutely necessary.
Comment 2 Sahana Prasad 2021-08-03 17:32:22 UTC 

*** This bug has been marked as a duplicate of bug 1985362 ***