I am running the following commands to compile openssl (with FIPS support) and stunnel 

* Base config for FIPS

cd openssl-fips-2.0.9

echo "./config"

./config 

* OpenSSL with shared and custom install location

cd openssl-1.0.1m

echo "./config fips --openssldir=/usr/local/openssl-100 --with-fipslibdir=/usr/local/ssl/fips-2.0/lib"

./config fips shared --openssldir=/usr/local/openssl-100 --with-fipslibdir=/usr/local/ssl/fips-2.0/lib/

* Stunnel with FIPs (autodetect is working , I just added it to force it)

cd stunnel-5.09

echo "make clean"

make clean

echo "./configure --with-ssl=/usr/local/openssl-100 --disable-libwrap --enable-fips"

./configure --with-ssl=/usr/local/openssl-100 --disable-libwrap --enable-fips

You can see that my custom OpenSSL is reporting that it is built with -fips

root@host:/var/tmp# /usr/local/openssl-100/bin/openssl version

OpenSSL 1.0.1m-fips 19 Mar 2015

But when I'm done with all the compile options -- I only see the base version of OpenSSL 1.0.1m , and this same script with Stunnel 4.53 shows OpenSSL 1.0.1m-fips 

Is there something I am missing during the configure for Stunnel that is causing it to NOT see openssl is compiled with FIPs?

root@host:/var/tmp# stunnel -version

stunnel 5.09 on x86_64-unknown-linux-gnu platform

Compiled with OpenSSL 1.0.1m 19 Mar 2015

Running  with OpenSSL 1.0.1 14 Mar 2012

Update OpenSSL shared libraries or rebuild stunnel

Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI

 

Global options:

debug                  = daemon.notice

RNDbytes               = 64

RNDfile                = /dev/urandom

RNDoverwrite           = yes

 

Service-level options:

ciphers                = FIPS (with "fips = yes")

ciphers                = HIGH:MEDIUM:+3DES:+DH:!aNULL:!SSLv2 (with "fips = no")

curve                  = prime256v1

options                = NO_SSLv2

options                = NO_SSLv3

sessionCacheSize       = 1000

sessionCacheTimeout    = 300 seconds

stack                  = 65536 bytes

TIMEOUTbusy            = 300 seconds

TIMEOUTclose           = 60 seconds

TIMEOUTconnect         = 10 seconds

TIMEOUTidle            = 43200 seconds

verify                 = none