Summary
Add configuration mode CLI to enable FIPS-compatible OpenSSL modules.
Proposed CLI:
set system option fips
In the backend, it should install FIPS modules:
sudo openssl fipsinstall \ -module /usr/lib/x86_64-linux-gnu/ossl-modules/fips.so \ -out /usr/lib/ssl/fipsmodule.cnf
It should render OpenSSL config:
vyos@r14:~$ sudo sed -i 's|^# \[default_sect\]|[default_sect]\nactivate = 1|' /etc/ssl/openssl.cnf
vyos@r14:~$ grep -n "default_sect" /etc/ssl/openssl.cnf
58:default = default_sect
71:[default_sect]
vyos@r14:~$
vyos@r14:~$
vyos@r14:~$ openssl list -providers
Providers:
default
name: OpenSSL Default Provider
version: 3.1.2
status: active
fips
name: OpenSSL FIPS Provider
version: 3.1.2
status: active
vyos@r14:~$It MUST disable the default providers. Implementation relies on the T8508
For simple tests:
# Must work (FIPS-approved) echo test | openssl dgst -sha256 # Must FAIL (non-FIPS) echo test | openssl dgst -md5 # Must FAIL (non-FIPS) openssl enc -des3 -k test -in /dev/null # Check available ciphers - no CHACHA, no RC4, no DES openssl list -cipher-algorithms | grep -iE "chacha|rc4|des|md5"