Upgrading OpenSSL with FIPS

NetApp Manageability SDK provides core libraries and OpenSSL with FIPS libraries. If you want to upgrade your OpenSSL with FIPS version, you can download OpenSSL and FIPS source code and build the libraries for your applications.

Prerequisites

You must download the latest version of OpenSSL and FIPS and extract it to a folder. Perform the following steps to download and extract the latest version of OpenSSL and FIPS:

Download the OpenSSL and FIPS tarball by entering http://www.openssl.org/source in your web browser.

Find the latest versions of openssl and openssl-fips, and then save the .tar.gz file.

Building OpenSSL libraries on Linux platform

To build OpenSSL and FIPS libraries on Linux platform, perform the following steps:

Create a directory Build_openssl

Change directory: $ cd Build_openssl

Copy the latest openssl-x.x.x.tar.gz file and openssl-fips-x.x.x.tar.gz to Build_openssl directory.

Copy the Makefile from \src\Openssl_Fips directory to Build_openssl directory.

To build the libraries for the required version, replace the version of the openssl-fips and openssl in the Makefile.

For an example, you have the files, openssl-fips-2.0.13.tar.gz and openssl-1.0.2h.tar.gz. If you want to build the libraries for the openssl-fips-2.0.x and openssl-1.0.x, then replace the current version of the file with the required version as shown below:

◦

replace openssl-fips-2.0.13.tar.gz with openssl-fips-2.0.x.tar.gz

◦

replace openssl-1.0.2h.tar.gz with openssl-1.0.x.tar.gz

Execute Makefile

New libraries libcrypto.a, libcrypto.so, libssl.a, libssl.so are created in the Build_openssl/ssl/lib directory.

Building OpenSSL libraries in a Windows platform

To build OpenSSL and FIPS libraries in a Windows 32-bit platform, perform the following steps:

Navigate to the openssl-fips extract folder from the Visual Studio command prompt.

Execute ms\do_fips no-asm

After successful build, set FIPSDIR= c:\fips\path where c:\fips\path is the location of FIPS module that was installed in the Step 1. Static and shared library builds are supported.

Navigate to the OpenSSL extract folder from the Visual Studio command prompt.

Configure OpenSSL: perl Configure VC-WIN32 fips --with-fipslibdir=c:\fips\path no-asm no-idea no-rc5 > win-config.out

The configuration information is saved in the win-config.out file.

Execute ms\do_ms.bat

ms\ssleay32.def, ms\libeay32.def, ms\ntdll.mak, ms\nt.mak and ms\version32.rc files are generated.

Generate OpenSSL dynamic libraries: nmake -f ms\ntdll.mak

New libraries libeay32.dll and ssleay32.dll are created in the openssl-x.x.x/out32dll directory.

To build OpenSSL and FIPS libraries in a Windows 64-bit platform, perform the following steps:

Navigate to the openssl-fips extract folder from the Visual Studio command prompt.

Execute ms\do_fips no-asm

After successful build, set FIPSDIR= c:\fips\path where c:\fips\path is the location of FIPS module that was installed in the Step 1. Static and shared library builds are supported.

Navigate to the OpenSSL extract folder from the Visual Studio x64 cross tools command prompt.

Configure OpenSSL: perl Configure VC-WIN64A fips --with-fipslibdir=c: \fips\path no-asm no-idea no-rc5 > win-config.out

The configuration information is saved in the win-config.out file.

Ensure that the path for ml64.exe is added to environment variable path. ml64.exe is located in C:\Program Files (x86)\Microsoft Visual Studio 8\VC\bin\x86_amd64\.

Execute ms\do_win64a.bat

ms\ssleay32.def, ms\libeay32.def, ms\ntdll.mak, ms\nt.mak and ms\version32.rc files are generated.

Generate OpenSSL dynamic libraries: nmake -f ms\ntdll.mak

New libraries libeay32.dll and ssleay32.dll are created in the openssl-x.x.x/out32dll directory.

Parent topic: Getting started with SDK