OpenSSL 3.0 With FIPS Provider on Alpine Linux Container

The latest verified FIPS module version is v3.0.9(2024/07/12), check https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4282.

OpenSSL 3.0 (Enable FIPS Module/Provider)

Summary

Remove Vendor official openssl
Install development purpose software
Build OpenSSL 3.0 with "fips" parameter to build FIPS provider
Install OpenSSL 3.0 or only install OpenSSL 3.0 FIPS provider
Configure OpenSSL configuration to enable FIPS Provider

How to Use

Build Your Own Container image

docker build -t alpine-fips:latest -f Dockerfile .

Use Pre-Build Image

docker pull shuimqcn/alpine-fips:latest

Use Pre-Build FIPS Provider

Run alpine 3.20 container
Copy "fips.so" from "libs/3.0.9/fips.so" or "shuimqcn/alpine-fips:latest:/usr/lib/ossl-modules/fips.so" into "/usr/lib/ossl-modules/fips.so"
Use "openssl fipsinstall" to generate "fipsmodule.cnf" by "/usr/lib/ossl-modules/fips.so" openssl fipsinstall -out /etc/ssl/fipsmodule.cnf -module /usr/lib/ossl-modules/fips.so
Modify "openssl.cnf" to enable FIPS provider

More information can refer to Dockerfile stage 2.

Test

#include <stdio.h>
#include <openssl/evp.h>
#include <openssl/provider.h>

int main() {
    OSSL_PROVIDER *fips_provider = NULL;
    OSSL_PROVIDER *default_provider = NULL;
    int result = 1;

    // Load default provider
    default_provider = OSSL_PROVIDER_load(NULL, "default");
    if (!default_provider) {
        fprintf(stderr, "Loading default provider failed.\n");
        goto end;
    }

    // Load FIPS Provider
    fips_provider = OSSL_PROVIDER_load(NULL, "fips");
    if (!fips_provider) {
        fprintf(stderr, "Loading FIPS provider failed.\n");
        goto end;
    }

    // Check FIPS Provider whether works well
    if (EVP_default_properties_is_fips_enabled(NULL)) {
        printf("FIPS module enabled and works well.\n");
        result = 0;
    } else {
        printf("FIPS module not enabled or can not work.\n");
    }

end:
    // Clean Provider object 
    if (fips_provider) OSSL_PROVIDER_unload(fips_provider);
    if (default_provider) OSSL_PROVIDER_unload(default_provider);

    return result;
}

Compile

/ # gcc -o fips_test fips_test.c -lcrypto -ldl

Run

/ # ./fips_test
FIPS module enabled and works well.
/ #