Bringing back FIPS_mode() define
@Dimitri John Ledkov (Chainguard) has raised a PR to bring back the FIPS_mode() define that used to exist in OpenSSL before 3.0.
https://github.com/openssl/openssl/pull/30339
The FIPS_mode() symbol is present in various popular distros added there as downstream patch and in OpenSSL forks. The semantics is not as well defined, but it may be a good hint that applications shouldn't use the non-FIPS-approved algorithms.
Do you support reinstantiation of this macro?
poll by Dmitry Belyavsky Closed Fri 20 Mar 2026 8:00AM
Results
| Results | Option | % of points | Voters | |||
|---|---|---|---|---|---|---|
| Yes, in 4.0 | 88 | 7 |      | |||
| Yes, in 4.x series | 13 | 1 |  | |||
| No | 0 | 0 | ||||
| Undecided | 34 |                .jpeg){kind=small}  |
Simon JohnWed 11 Mar 2026 8:37AM
RHEL-alike distro's that have gone through FIPS 140-3 validation like AlmaLinux are already defining this macro this via patches for some level of backwards compatibility.
It must be highlighted that its only a hint that FIPS mode is enabled and testing for successful loading of the provider (passing self-tests etc.) should be handled by the user, just like FIPS indicators. And perhaps that it should only be used for backwards-compatibility and not new code?