Title: Enable FIPS 140-2 Cryptography for SSL on Red Hat Enterprise Linux 6 Describe the issue: In this chapter is described info how to enable FIPS in HTTPs WebConnector etc., but even I'd proceeded these steps, and after I've tried to start Apache HTTPd server in error_log I can see "SSL FIPS mode disabled", so obviously, there is some missing part for enabling FIPS in Apache HTTPd. Suggestions for improvement: Add description how to enable FIPS in Pache HTTPd server.
FIPS is supported in EAP, so it should be documented how to enable/configure it. However it seems it is broken now (see BZ#1086412).
Hi Nidhi, I don't test these features, so I can't answer this question by myself. I'm forwarding your questions to our security expert Josef. @Josef Could you take a looks and answer the question from Nidhi's comment 9 please?
Sorry, I don't have experiences with natives in this area. Michal, do you have some answers/advices?
Hi Josef, Nidhi, Pavel, Regarding documentation (relevant to this bugzilla) ----------------------- the FIPS regime is enabled by adding SSLFIPS on directive to the Apache HTTP Server configuration, e.g. to ssl.conf or httpd.conf (must be outside VirtualHost configuration). The result in the Apache HTTP Server error_log: [notice] Operating in SSL FIPS mode (verified with EAP 6.3.0.ER7 Apache HTTP Server zip distribution) Regarding some FIPS related bugs (not relevant for this bugzilla) -------------------------------- I have the same problem on RHEL7 as it's described here [1], i.e. [error] SSL Library Error: 755449965 error:2D07406D:FIPS routines:RSA_BUILTIN_KEYGEN:invalid key length I'll take a look at it and eventually clone the bugzilla. I might have an old RHEL7 instance... On RHEL6, it works just fine for me. [1] https://bugzilla.redhat.com/show_bug.cgi?id=1071292
I don't know whether we could assume it being obvious, but one has to have FIPS capable OpenSSL installed....
Thanks for the update. There is a small bug: Apache HTTP server configuration files: httpd.conf and ssl.conf. should be rather something like: Apache HTTP server configuration file: httpd.conf or ssl.conf. Explanation: It actually does not matter where it is. To have it in _both_ files is wrong though. IMHO ssl.conf would actually be a good practice for this directive.
Looks good to me.