# HAProxy in FIPS Mode

**URL:** <https://discourse.haproxy.org/t/haproxy-in-fips-mode/9589>\
**Category:** Help!\
**Created:** [March 6, 2024, 6:29pm UTC](https://discourse.haproxy.org/t/haproxy-in-fips-mode/9589 "2024-03-06T18:29:10Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ArunViswanath](https://avatars.discourse-cdn.com/v4/letter/a/4491bb/32.png) [@ArunViswanath](https://discourse.haproxy.org/u/ArunViswanath)\
**Post date:** [March 6, 2024, 6:29pm UTC](https://discourse.haproxy.org/t/haproxy-in-fips-mode/9589/1 "2024-03-06T18:29:10Z")

</div>

Hi.  
I need to enable FIPS mode on the Community Edition HA Proxy. On reading certain documents on the HA Proxy site, they mention that HA Proxy depends on the OpenSSL installed on the system. If the OpenSSL version(OpenSSL 1.1.1f 31 Mar 2020) deployed is FIPS Compliant then the HA Proxy installed on the system will also be in FIPS mode. Can anyone confirm, that OpenSSL FIPS enabled is the only dependency or do we need to do some extra configuration on HA to run it on FIPS mode?

Do we need an Enterprise version HA Proxy to enable FIPS (say FIPS mode can be enabled only with the Enterprise version), or is only a community edition with OpenSSL FIPS mode sufficient?

I really appreciate any help you can provide.  
Arun V

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [March 6, 2024, 8:47pm UTC](https://discourse.haproxy.org/t/haproxy-in-fips-mode/9589/2 "2024-03-06T20:47:13Z")

</div>

Also see:

> <https://github.com/haproxy/haproxy/issues/2448>
>
> \### Your Feature Request
> 
> As part of Haproxy \_\_ssl\_sock\_init startup operation…, we are avoiding the initialization call if linked OpenSSL library is ssl6 or below :-
> 
> \`\`\`
> \#if HA\_OPENSSL\_VERSION\_NUMBER \< 0x10100000L
> SSL\_library\_init();
> \#endif
> \`\`\`
> https://github.com/haproxy/haproxy/blob/613e959c7bf65cf43a9c3cd4abdb1c0593b0beb8/src/ssl\_sock.c#L7498
> 
> We know that starting OpenSSL 1.1.X it does dynamic initialization, but if any one needs explicit initialization when they want to do something like setting FIPS or something to do with engine as part of initialization .
> 
> 
> https://www.openssl.org/docs/man1.1.1/man3/OPENSSL\_init\_ssl.html
> 
> “ there may be situations when explicit initialization is desirable or needed, for example when some nondefault initialization is required.”
> 
> Note:- We use custom OpenSSL 1.1.1 which we have got FIPS approved , so in order to enable FIPS mode we rely on OPENSSL\_init\_ssl initialization. 
> 
> I did below code on haproxy which has helped us with our problems. 
> 
> \`\`\`
> \#if HA\_OPENSSL\_VERSION\_NUMBER \< 0x10100000L
> SSL\_library\_init();
> \#elif
> OPENSSL\_init\_ssl(OPENSSL\_INIT\_LOAD\_SSL\_STRINGS | OPENSSL\_INIT\_LOAD\_CRYPTO\_STRINGS, NULL);
> \#endif
> \`\`\`
> 
> So we would like to understand the possibility of allowing this implementation and if there are any implications.
> 
> 
> 
> \### What are you trying to do?
> 
> we need an explicity initialization call irrespective of openssl doing dynamic allocations so that we can do like setting/enabling/disabling FIPS mode or so.
> 
> \### Output of \`haproxy -vv\`
> 
> \`\`\`plain
> \[root@cucm-8 HAPROXY\]# ./haproxy -ddd -f ./haproxy\_new.conf -vvv
> HA-Proxy version 2.2.32-4081d5a 2023/12/19 - https://haproxy.org/
> Status: long-term supported branch - will stop receiving fixes around Q2 2025.
> Known bugs: http://www.haproxy.org/bugs/bugs-2.2.32.html
> Running on: Linux 4.18.0-372.16.1.el8\_6.x86\_64 #1 SMP Wed Jul 13 03:56:16 EDT 2022 x86\_64
> Build options :
> TARGET = custom
> CPU = generic
> CC = gcc
> CFLAGS = -m64 -march=x86-64 -O2 -g -Wall -Wextra -Wdeclaration-after-statement -fwrapv -Wno-unused-label -Wno-sign-compare -Wno-unused-parameter -Wno-clobbered -Wno-missing-field-initializers -Wno-stringop-overflow -Wno-cast-function-type -Wtype-limits -Wshift-negative-value -Wshift-overflow=2 -Wduplicated-cond -Wnull-dereference
> OPTIONS = USE\_EPOLL=1 USE\_THREAD=1 USE\_LINUX\_SPLICE=1 USE\_OPENSSL=1 USE\_CPU\_AFFINITY=1
> DEBUG =
> 
> Feature list : -51DEGREES -ACCEPT4 -BACKTRACE -CLOSEFROM +CPU\_AFFINITY -CRYPT\_H -DEVICEATLAS -DL +EPOLL -EVPORTS -FUTEX -GETADDRINFO -KQUEUE -LIBCRYPT +LINUX\_SPLICE -LINUX\_TPROXY -LUA -NETFILTER -NS -OBSOLETE\_LINKER +OPENSSL -PCRE -PCRE2 -PCRE2\_JIT -PCRE\_JIT +POLL -PRCTL -PRIVATE\_CACHE -PTHREAD\_PSHARED -RT -SLZ -STATIC\_PCRE -STATIC\_PCRE2 -SYSTEMD -TFO +THREAD -THREAD\_DUMP -TPROXY -WURFL -ZLIB
> 
> Default settings :
> bufsize = 16384, maxrewrite = 1024, maxpollevents = 200
> 
> Built with multi-threading support (MAX\_THREADS=64, default=2).
> Built with OpenSSL version : OpenSSL 1.1.1t.7.2.500
> Running on OpenSSL version : OpenSSL 1.1.1t.7.2.500
> OpenSSL library supports TLS extensions : yes
> OpenSSL library supports SNI : yes
> OpenSSL library supports : TLSv1.0 TLSv1.1 TLSv1.2 TLSv1.3
> Built without compression support (neither USE\_ZLIB nor USE\_SLZ are set).
> Compression algorithms supported : identity("identity")
> Built with transparent proxy support using: IP\_TRANSPARENT IPV6\_TRANSPARENT IP\_FREEBIND
> Built without PCRE or PCRE2 support (using libc's regex instead)
> Encrypted password support via crypt(3): no
> Built with gcc compiler version 8.5.0 20210514 (Red Hat 8.5.0-10)
> 
> Available polling systems :
> epoll : pref=300, test result OK
> poll : pref=200, test result OK
> select : pref=150, test result OK
> Total: 3 (3 usable), will use epoll.
> 
> Available multiplexer protocols :
> (protocols marked as \<default\> cannot be specified using 'proto' keyword)
> fcgi : mode=HTTP side=BE mux=FCGI
> \<default\> : mode=HTTP side=FE|BE mux=H1
> h2 : mode=HTTP side=FE|BE mux=H2
> \<default\> : mode=TCP side=FE|BE mux=PASS
> 
> Available services : none
> 
> Available filters :
> \[SPOE\] spoe
> \[COMP\] compression
> \[TRACE\] trace
> \[CACHE\] cache
> \[FCGI\] fcgi-app
> \`\`\`