Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: pass (nike.apache.org: domain of cbeckey@gmail.com designates
 209.85.128.47 as permitted sender)
From: Chris Beckey <cbeckey@gmail.com>
Content-Type: multipart/alternative;
 boundary="Apple-Mail=_F643F35F-8BB1-4E13-8461-BBFE9F46A7C8"
Subject: Re: TCNative with FIPS OpenSSL throws fingerprint error in FIPS mode
Date: Wed, 12 Jun 2013 08:08:21 -0400
Message-Id: <EDA7282C-B409-46B4-AF80-42268E87DF2A@gmail.com>
To: users@tomcat.apache.org
Mime-Version: 1.0 (Apple Message framework v1283)

--Apple-Mail=_F643F35F-8BB1-4E13-8461-BBFE9F46A7C8
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii

Getting FIPS mode turned on and running is, unfortunately, far more =
complex than getting the libs, or even building them, and installing =
them.
You need to follow the directions for building the FIPS module here:
http://www.openssl.org/docs/fips/fipsnotes.html
-and-
http://www.openssl.org/docs/fips/UserGuide.pdf

I've gone through this for OpenSSL 0.9 (FIPS 1.2), not for 2.0 and it is =
a process that takes a day at least, more likely two or three including =
collecting all the right tools.  Keep in mind that you are trying to =
build an exact version of a library, not a functionally equivalent =
version. Things like compiler version make a difference.

Basically, the process assures that the libs you build are validated as =
not having been changed since they were built and they were built from =
the unchanged source  This involves a series of steps to validate =
everything from the downloaded source through to the finished lib.  =
Unfortunately I don't have access to the libs I built, they could get =
you through testing.  They would NOT be acceptable as genuinely FIPS =
compliant because you need to document the build process, including the =
signatures at each step, and keep that documentation.

The error you are getting is expected because the lib you've built won't =
have the correct fingerprint (basically a hash of the lib) as compared =
to the known value.  When you start FIPS mode, it runs validation on the =
loaded libraries.  You'll probably notice a marked delay when it does =
start up correctly in FIPS mode.


--Apple-Mail=_F643F35F-8BB1-4E13-8461-BBFE9F46A7C8--