Become FIPS Compliant with HAProxy Enterprise on Red Hat Enterprise Linux 8

blog20200902-01.sh

$ openssl version
OpenSSL 1.1.1c FIPS 28 May 2019

blog20200902-02.sh

$ sudo fips-mode-setup --check
Installation of FIPS modules is not completed.
FIPS mode is disabled.

blog20200902-03.sh

$ sudo fips-mode-setup --enable
Kernel initramdisks are being regenerated. This might take some time.
Setting system policy to FIPS
Note: System-wide crypto policies are applied on application start-up.
It is recommended to restart the system for the change of policies to fully take place.
FIPS mode will be enabled.
Please reboot the system for the settings to take effect.

blog20200902-04.sh

$ sudo fips-mode-setup --check
FIPS mode is enabled.

blog20200902-05.sh

$ openssl md5 /dev/null
Error setting digest
139634625394496:error:060800C8:digital envelope routines:EVP_DigestInit_ex:disabled for FIPS:crypto/evp/digest.c:135:

blog20200902-06.sh

$ cat /proc/sys/crypto/fips_enabled
1

$ sysctl crypto.fips_enabled
crypto.fips_enabled = 1

blog20200902-07.sh

$ update-crypto-policies --show
FIPS

blog20200902-08.cfg

frontend fe_main
    bind :80
    bind :443 ssl  crt /etc/hapee-2.1/certs/ssl.pem  ssl-min-ver TLSv1.2  ciphers PROFILE=SYSTEM  ciphersuites PROFILE=SYSTEM
    http-request redirect scheme https unless { ssl_fc }
    default_backend servers

blog20200902-09.sh

$ sudo systemctl restart hapee-2.1-lb

blog20200902-10.sh

$ openssl ciphers PROFILE=SYSTEM
# List of algorithms is displayed…