OPENSSL-FIPSINSTALL(1ssl) OpenSSL OPENSSL-FIPSINSTALL(1ssl) (NAME) openssl-fipsinstall - FIPS (SYNOPSIS) openssl fipsinstall [-help] [-in configfilename] [-out configfilename] [-module modulefilename] [-provider_name providername] [-section_name sectionname] [-verify] [-mac_name macname] [-macopt nm:v] [-noout] [-quiet] [-pedantic] [-no_conditional_errors] [-no_security_checks] [-hmac_key_check] [-kmac_key_check] [-ems_check] [-no_drbg_truncated_digests] [-signature_digest_check] [-hkdf_digest_check] [-tls13_kdf_digest_check] [-tls1_prf_digest_check] [-sshkdf_digest_check] [-sskdf_digest_check] [-x963kdf_digest_check] [-dsa_sign_disabled] [-no_pbkdf2_lower_bound_check] [-no_short_mac] [-tdes_encrypt_disabled] [-rsa_pkcs15_padding_disabled] [-rsa_pss_saltlen_check] [-rsa_sign_x931_disabled] [-hkdf_key_check] [-kbkdf_key_check] [-tls13_kdf_key_check] [-tls1_prf_key_check] [-sshkdf_key_check] [-sskdf_key_check] [-x963kdf_key_check] [-x942kdf_key_check] [-ecdh_cofactor_check] [-self_test_onload] [-self_test_oninstall] [-corrupt_desc selftest_description] [-corrupt_type selftest_type] [-config parent_config] (DESCRIPTION) FIPS . FIPS FIPS . FIPS MAC KAT ( ) . : - MAC FIPS. - . (KAT) . - MAC . - . ( ) FIPS . '1' FIPS . '0' . ( ) . . - . . '1' . '0' FIPS . fips_config(5) . (OPTIONS) -help . -module filename FIPS . OPENSSL_MODULES . -out configfilename . -in configfilename . -verify . -verify . -provider_name providername . "fips" . -section_name sectionname . "fips_sect" . -mac_name name MAC . MAC OpenSSL . MAC "openssl list -mac-algorithms" . HMAC . -macopt nm:v MAC . EVP_MAC . : key:string MAC ( ). MAC . MAC . OpenSSL . hexkey:string MAC ( ). MAC . MAC . OpenSSL . digest:string HMAC ( ). MAC . "openssl list -digest-commands" . SHA-256 . -noout . -pedantic FIPS . . FIPS . -no_conditional_errors . -no_security_checks . "no-fips-securitychecks" . -ems_check TLS1_PRF KDF Extended Master Secret (EMS) . . EMS RFC 7627 . -no_short_mac MAC . SP 800-185 8.4.2 FIPS 140-3 ID C.D . -hmac_key_check HMAC . SP 800-131Ar2 . -kmac_key_check KMAC . SP 800-131Ar2 . -no_drbg_truncated_digests Hash DRBG HMAC DRBG . FIPS 140-3 IG D.R . -signature_digest_check . -hkdf_digest_check . -tls13_kdf_digest_check TLS13 KDF . RFC 8446 . -tls1_prf_digest_check TLS_PRF . NIST SP 800-135r1 . -sshkdf_digest_check SSHKDF . NIST SP 800-135r1 . -sskdf_digest_check . -x963kdf_digest_check X963KDF . NIST SP 800-131Ar2 . -dsa_sign_disabled DSA ( DSA ). FIPS 140-3 IG C.K . -tdes_encrypt_disabled Triple-DES . Triple-DES . SP800-131Ar2 . -rsa_pkcs15_padding_disabled 1.5 PKCS#1 RSA . NIST SP 800-131A . -rsa_pss_saltlen_check RSA-PSS . FIPS 186-5 5.4 (g) . -rsa_sign_x931_disabled RSA X9.31 . FIPS 140-3 IG C.K . -hkdf_key_check HKDF . NIST SP 800-131Ar2 . -kbkdf_key_check KBKDF . NIST SP 800-131Ar2 . -tls13_kdf_key_check TLS13 KDF . NIST SP 800-131Ar2 . -tls1_prf_key_check TLS_PRF . NIST SP 800-131Ar2 . -sshkdf_key_check SSHKDF . NIST SP 800-131Ar2 . -sskdf_key_check SSKDF . NIST SP 800-131Ar2 . -x963kdf_key_check X963KDF . NIST SP 800-131Ar2 . -x942kdf_key_check X942KDF . NIST SP 800-131Ar2 . -no_pbkdf2_lower_bound_check PBKDF2 . NIST SP 800-132 . -ecdh_cofactor_check ECDH . 'B' 'K' . 5.7.1.2 SP 800-56A r3 . -self_test_onload <> <> . KAT . (cross compiling) . . OpenSSL FIPS 140-2 ( OpenSSL 3.0.X) 0 OpenSSL FIPS 140-3 . -self_test_oninstall -self_test_onload. <> <> . OpenSSL FIPS 140-3 . -quiet / (pass/fail). -noout . -corrupt_desc selftest_description, -corrupt_type selftest_type . . st-desc st-type OSSL_PROVIDER-FIPS(7) . -config parent_config FIPS . "parent_config" . config(5) . '-config' . (NOTES) -quiet -noout -corrupt_desc -corrupt_type . fips fips fipsinstall . -corrupt_desc -corrupt_type . fips . -self_test_oninstall -self_test_onload OpenSSL 3.1 . OpenSSL 3.0 . (EXAMPLES) mac FIPS fips.so FIPS fips.cnf: openssl fipsinstall -module ./fips.so -out fips.cnf -provider_name fips fips.cnf : openssl fipsinstall -module ./fips.so -in fips.cnf -provider_name fips -verify "SHA1" : openssl fipsinstall -module ./fips.so -out fips.cnf -provider_name fips \ -corrupt_desc 'SHA1' fips : export OPENSSL_CONF_INCLUDE= export OPENSSL_MODULES= openssl fipsinstall -config' 'default.cnf' (SEE ALSO) config(5), fips_config(5), OSSL_PROVIDER-FIPS(7), EVP_MAC(3) (HISTORY) openssl-fipsinstall OpenSSL 3.0 . OpenSSL 3.1 : -ems_check, -self_test_oninstall OpenSSL 3.2 : -pedantic, -no_drbg_truncated_digests OpenSSL 3.4 : -hmac_key_check, -kmac_key_check, -signature_digest_check, -hkdf_digest_check, -tls13_kdf_digest_check, -tls1_prf_digest_check, -sshkdf_digest_check, -sskdf_digest_check, -x963kdf_digest_check, -dsa_sign_disabled, -no_pbkdf2_lower_bound_check, -no_short_mac, -tdes_encrypt_disabled, -rsa_pkcs15_padding_disabled, -rsa_pss_saltlen_check, -rsa_sign_x931_disabled, -hkdf_key_check, -kbkdf_key_check, -tls13_kdf_key_check, -tls1_prf_key_check, -sshkdf_key_check, -sskdf_key_check, -x963kdf_key_check, -x942kdf_key_check, -ecdh_cofactor_check (COPYRIGHT) 2019-2025 The OpenSSL Project Authors . . 2.0 (<<>>) . . LICENSE . 3.6.4 2026-08-25 OPENSSL-FIPSINSTALL(1ssl)