#
# [openssl_init] configuration tree for FIPS enabled mode
#

# For FIPS
# Optionally include a file that is generated by the OpenSSL fipsinstall
# application. This file contains configuration data required by the OpenSSL
# fips provider. It contains a named section e.g. [fips_sect] which is
# referenced from the [provider_sect] below.
# Refer to the OpenSSL security policy for more information.
# .include fipsmodule.cnf

.include /etc/ssl/fipsmodule.cnf

[openssl_init]
random = random_sect
alg_section = alg_sect
providers = provider_sect
ssl_conf = ssl_module

[random_sect]
seed = jitterentropy

[provider_sect]
jitterentropy = jitterentropy_sect
fips = fips_sect

[jitterentropy_sect]
activate = 1

[alg_sect]
default_properties = fips=$ENV::OPENSSL_FIPS

[ssl_module]
system_default = system_default_sect

[system_default_sect]
# Set MIN TLS to v1.2(TLS 1.0 and 1.1 rely on MD5/SHA1 combinations)
MinProtocol = TLSv1.2
CipherString = HIGH:!aNULL:!eNULL:!MD5:!3DES:!RC4:!CHACHA20:!ARIA:@SECLEVEL=2
Ciphersuites = TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256