diff options
| author | Pauli <pauli@openssl.org> | 2021-07-29 11:39:01 +1000 |
|---|---|---|
| committer | Pauli <pauli@openssl.org> | 2021-07-30 15:41:06 +1000 |
| commit | 5540855bda5e58f4b33f2306feb6ff4e93c0af81 (patch) | |
| tree | 9947d9e2aaa35ae138fee810c885d5e7d2f9a8f7 /doc/man7/fips_module.pod | |
| parent | 58bd45d86fcf7afc95a542de0a9b1d07eda1c7e6 (diff) | |
doc: document that config_diagnostics is sensible but involves risk
Also:
- add this option to the sample configurations in the documentation.
- note that it is a sensible choice when using FIPS via config
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/16172)
Diffstat (limited to 'doc/man7/fips_module.pod')
| -rw-r--r-- | doc/man7/fips_module.pod | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/doc/man7/fips_module.pod b/doc/man7/fips_module.pod index 1d709be513..b47ed279f6 100644 --- a/doc/man7/fips_module.pod +++ b/doc/man7/fips_module.pod @@ -73,6 +73,7 @@ F</usr/local/ssl/openssl.cnf>. Edit the config file to add the following lines near the beginning: + config_diagnostics = 1 openssl_conf = openssl_init .include /usr/local/ssl/fipsmodule.cnf @@ -91,6 +92,10 @@ Obviously the include file location above should match the path and name of the FIPS module config file that you installed earlier. See L<https://github.com/openssl/openssl/blob/master/README-FIPS.md>. +For FIPS usage, it is recommened that the B<config_diagnostics> option is +enabled to prevent accidental use of non-FIPS validated algorithms via broken +or mistaken configuration. See L<config(5)>. + Any applications that use OpenSSL 3.0 and are started after these changes are made will start using only the FIPS module unless those applications take explicit steps to avoid this default behaviour. Note that this configuration @@ -273,6 +278,7 @@ sets the default property value to be C<fips=yes>. Note that this config file does not load the "base" provider. All supporting algorithms that are in "base" are also in "default", so it is unnecessary in this case: + config_diagnostics = 1 openssl_conf = openssl_init .include /usr/local/ssl/fipsmodule.cnf |