Support FIPS in APISIX

OpenSSL 3.0 supports FIPS mode. To support FIPS in APISIX, you can compile apisix-base with OpenSSL 3.0.

Compilation

To compile apisix-base with OpenSSL 3.0, run the commands below as root user:

  1. cd $(mktemp -d)
  2. OPENSSL3_PREFIX=${OPENSSL3_PREFIX-/usr/local}
  3. apt install -y build-essential
  4. git clone https://github.com/openssl/openssl
  5. cd openssl
  6. ./Configure --prefix=$OPENSSL3_PREFIX/openssl-3.0 enable-fips
  7. make install
  8. echo $OPENSSL3_PREFIX/openssl-3.0/lib64 > /etc/ld.so.conf.d/openssl3.conf
  9. ldconfig
  10. $OPENSSL3_PREFIX/openssl-3.0/bin/openssl fipsinstall -out $OPENSSL3_PREFIX/openssl-3.0/ssl/fipsmodule.cnf -module $OPENSSL3_PREFIX/openssl-3.0/lib64/ossl-modules/fips.so
  11. sed -i 's@# .include fipsmodule.cnf@.include '"$OPENSSL3_PREFIX"'/openssl-3.0/ssl/fipsmodule.cnf@g; s/# \(fips = fips_sect\)/\1\nbase = base_sect\n\n[base_sect]\nactivate=1\n/g' $OPENSSL3_PREFIX/openssl-3.0/ssl/openssl.cnf
  12. cd ..
  14. export cc_opt="-I$OPENSSL3_PREFIX/openssl-3.0/include"
  15. export ld_opt="-L$OPENSSL3_PREFIX/openssl-3.0/lib64 -Wl,-rpath,$OPENSSL3_PREFIX/openssl-3.0/lib64"
  17. wget https://raw.githubusercontent.com/api7/apisix-build-tools/master/build-apisix-base.sh
  18. chmod +x build-apisix-base.sh
  19. ./build-apisix-base.sh latest

This will install apisix-base to /usr/local/openresty-debug.