Skip to main content

Enabling/Disabling FIPS Cryptographic Modules

With HMG and HSG 3.7.5+, the hardware-based cryptographic modules are no longer used. Instead software-based FIPs modules are available. To enable them:

  1. SSH into your HMG or HSG.
  2. Elevate to root.
  3. Edit the /etc/pki/tls/openssl.cnf file and add the following after the oid_section = new_oids line:

    CODE
    # OpenSSL configuration fragment for HaiOS WolfEngine config.
    # Templated at build time with values.
    openssl_conf = openssl_init
    [openssl_init]
    engines = engine_section
    [engine_section]
    wolfSSL = wolfssl_section
    [wolfssl_section]
    engine_id = libwolfengine
    dynamic_path = /opt/haivision/usr/lib64/haios-openssl-engine/libwolfengine.so
    init = 1
    default_algorithms = ALL
    enable_fips_checks = 1
    # --- generated engine ctrl options below this line ---
  4. Edit the /opt/haivision/madra/conf/ssl/openssl.cnf file and add the following after the oid_section = new_oids line:

    CODE
    # OpenSSL configuration fragment for HaiOS WolfEngine config
    # Templated at build time with values.
    openssl_conf = openssl_init
    [openssl_init]
    engines = engine_section
    [engine_section]
    wolfSSL = wolfssl_section
    [wolfssl_section]
    engine_id = libwolfengine
    dynamic_path = /opt/haivision/usr/lib64/haios-openssl-engine/libwolfengine.so
    init = 1
    default_algorithms = ALL
    enable_fips_checks = 1
    # --- generated engine ctrl options below this line ---
  5. Reboot your Gateway.

To disable FIPS:

  1. SSH into your HMG or HSG.

  2. Elevate to root.

  3. Edit the /etc/pki/tls/openssl.cnf file and remove the changes made when enabling FIPS. See the procedure above.

  4. Edit the /opt/haivision/madra/conf/ssl/openssl.cnf file and remove the changes made when enabling FIPS. See the procedure above.
  5. Reboot your Gateway.
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.