Hello --
I am running the following commands to compile openssl (with FIPS support) and stunnel
* Base config for FIPS
cd openssl-fips-2.0.9
echo "./config"
./config
* OpenSSL with shared and custom install location
cd openssl-1.0.1m
echo "./config fips --openssldir=/usr/local/openssl-100 --with-fipslibdir=/usr/local/ssl/fips-2.0/lib"
./config fips shared --openssldir=/usr/local/openssl-100 --with-fipslibdir=/usr/local/ssl/fips-2.0/lib/
* Stunnel with FIPs (autodetect is working , I just added it to force it)
cd stunnel-5.09
echo "make clean"
make clean
echo "./configure --with-ssl=/usr/local/openssl-100 --disable-libwrap --enable-fips"
./configure --with-ssl=/usr/local/openssl-100 --disable-libwrap --enable-fips
You can see that my custom OpenSSL is reporting that it is built with -fips
root@host:/var/tmp# /usr/local/openssl-100/bin/openssl version
OpenSSL 1.0.1m-fips 19 Mar 2015
But when I'm done with all the compile options -- I only see the base version of OpenSSL 1.0.1m , and this same script with Stunnel 4.53 shows OpenSSL 1.0.1m-fips
Is there something I am missing during the configure for Stunnel that is causing it to NOT see openssl is compiled with FIPs?
root@host:/var/tmp# stunnel -version
stunnel 5.09 on x86_64-unknown-linux-gnu platform
Compiled with OpenSSL 1.0.1m 19 Mar 2015
Running with OpenSSL 1.0.1 14 Mar 2012
Update OpenSSL shared libraries or rebuild stunnel
Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI
Global options:
debug = daemon.notice
RNDbytes = 64
RNDfile = /dev/urandom
RNDoverwrite = yes
Service-level options:
ciphers = FIPS (with "fips = yes")
ciphers = HIGH:MEDIUM:+3DES:+DH:!aNULL:!SSLv2 (with "fips = no")
curve = prime256v1
options = NO_SSLv2
options = NO_SSLv3
sessionCacheSize = 1000
sessionCacheTimeout = 300 seconds
stack = 65536 bytes
TIMEOUTbusy = 300 seconds
TIMEOUTclose = 60 seconds
TIMEOUTconnect = 10 seconds
TIMEOUTidle = 43200 seconds
verify = none
