Configuring OpenSSL for FIPS 140-3 Compliance

You need FIPS 140-3 compliance, and you need it now.

FIPS 140-3 is the latest U.S. government cryptographic standard. It sets the rules for how cryptographic modules must be designed, implemented, and validated. Many regulated industries and government contracts require it. If your application handles sensitive data—finance, healthcare, defense—FIPS 140-3 can be the difference between a passed audit and a failed one.

OpenSSL is the most common cryptographic library in use today. It powers TLS, SSL, and core crypto functions for countless systems. But running OpenSSL in a FIPS-approved mode is not a default setting—you have to configure it, build it, and in many cases, validate it. With FIPS 140-3 replacing FIPS 140-2, updates to your cryptographic modules matter. Legacy builds will not automatically meet new requirements.

The OpenSSL team provides a FIPS 140-3 validated module for compatible versions. This module is separate from the main OpenSSL distribution. You must download, compile, and integrate it correctly. The typical setup involves:

1. Installing the FIPS Object Module approved under FIPS 140-3.
2. Linking it with a compatible OpenSSL version.
3. Configuring the runtime to load and enforce the FIPS provider.

To check that FIPS mode is active, you can run commands like:

openssl list -providers

Look for the fips provider in the output, and verify that your algorithms come from it.

For production, a validated cryptographic module must match the exact build and configuration tested by the certifying lab. Changing compiler flags or source code can void the certification. Always review the OpenSSL FIPS Security Policy for the validated module you plan to use.

There are challenges. FIPS mode disables certain algorithms. It enforces stricter key sizes. If your legacy systems use disallowed ciphers or hashes, upgrading requires code changes. Testing is essential before enabling FIPS mode in production.

Meeting FIPS 140-3 with OpenSSL is about precision and discipline—every detail matters from source build to runtime environment. Powerful crypto means nothing if it’s not compliant when it needs to be.

Want to see FIPS 140-3 OpenSSL in action without weeks of setup? Spin it up on hoop.dev and watch it go live in minutes.