<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Hello --<div><br></div><div> I am running the following commands to compile openssl (with FIPS support) and stunnel </div><div><br></div><div>* Base config for FIPS</div><div>
<p class="p1">cd openssl-fips-2.0.9</p>
<p class="p1">echo "./config"</p>
<p class="p1">./config </p></div><div><br></div><div>* OpenSSL with shared and custom install location</div><div>
<p class="p1">cd openssl-1.0.1m</p>
<p class="p1">echo "./config fips --openssldir=/usr/local/openssl-100 --with-fipslibdir=/usr/local/ssl/fips-2.0/lib"</p>
<p class="p1">./config fips shared --openssldir=/usr/local/openssl-100 --with-fipslibdir=/usr/local/ssl/fips-2.0/lib/</p></div><div><br></div><div>* Stunnel with FIPs (autodetect is working , I just added it to force it)</div><div>
<p class="p1">cd stunnel-5.09</p>
<p class="p1">echo "make clean"</p>
<p class="p1">make clean</p>
<p class="p1">echo "./configure --with-ssl=/usr/local/openssl-100 --disable-libwrap --enable-fips"</p>
<p class="p1">./configure --with-ssl=/usr/local/openssl-100 --disable-libwrap --enable-fips</p></div><div><br></div><div>You can see that my custom OpenSSL is reporting that it is built with -fips</div><div><br></div><div>
<p class="p1">root@host:/var/tmp# /usr/local/openssl-100/bin/openssl version</p>
<p class="p1">OpenSSL 1.0.1m-fips 19 Mar 2015</p>
<p class="p1"><br></p><p class="p1">But when I'm done with all the compile options -- I only see the base version of OpenSSL 1.0.1m , and this same script with Stunnel 4.53 shows OpenSSL 1.0.1m-fips </p><p class="p1"><br></p><p class="p1">Is there something I am missing during the configure for Stunnel that is causing it to NOT see openssl is compiled with FIPs?</p><p class="p1"><br></p><p class="p1">root@host:/var/tmp# stunnel -version</p>
<p class="p1">stunnel 5.09 on x86_64-unknown-linux-gnu platform</p>
<p class="p1">Compiled with OpenSSL 1.0.1m 19 Mar 2015</p>
<p class="p1">Running with OpenSSL 1.0.1 14 Mar 2012</p>
<p class="p1">Update OpenSSL shared libraries or rebuild stunnel</p>
<p class="p1">Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI</p>
<p class="p2"> </p>
<p class="p1">Global options:</p>
<p class="p1">debug = daemon.notice</p>
<p class="p1">RNDbytes = 64</p>
<p class="p1">RNDfile = /dev/urandom</p>
<p class="p1">RNDoverwrite = yes</p>
<p class="p2"> </p>
<p class="p1">Service-level options:</p>
<p class="p1">ciphers = FIPS (with "fips = yes")</p>
<p class="p1">ciphers = HIGH:MEDIUM:+3DES:+DH:!aNULL:!SSLv2 (with "fips = no")</p>
<p class="p1">curve = prime256v1</p>
<p class="p1">options = NO_SSLv2</p>
<p class="p1">options = NO_SSLv3</p>
<p class="p1">sessionCacheSize = 1000</p>
<p class="p1">sessionCacheTimeout = 300 seconds</p>
<p class="p1">stack = 65536 bytes</p>
<p class="p1">TIMEOUTbusy = 300 seconds</p>
<p class="p1">TIMEOUTclose = 60 seconds</p>
<p class="p1">TIMEOUTconnect = 10 seconds</p>
<p class="p1">TIMEOUTidle = 43200 seconds</p>
<p class="p1">verify = none</p></div> </div></body>
</html>