In addition to
OpenSSL provides general purpose crypto libraries. In context,
FIPS-mode merely removes access to all of the algorithms that have not been approved by
NIST. If in
FIPS mode, the following command should fail.
openssl md5 filename
On RedHat system at least, one can also find the status of
FIPS mode in the
proc file system.
The result of the command produces
FIPS is not enabled.) or
FIPS is enabled.).
Is it possible that one may need to regenerate certificates for the Web servers after entering
FIPS mode? Perhaps.
FIPS-mode requirement also a small part of applying a
STIG? There exists a very convenient website to view
STIG requirements. The
RHEL6 STIG is available at stigviewer.com. Included in the requirements are the commands to apply and verify the settings. It's quite easy to do. The official source is somewhat more difficult to use, but a
RHEL7 STIG does exists there. The
STIGs from the official sources are produced in XML and expected to be viewed with "STIG Viewer Version 2.7," which can be found in the list of
Update: the RHEL7 STIG is now available at stigviewer.com.
Do the very best you can do, and then let the Information Assurance Officer tell you what more may need to be done. In addition, one could choose to apply the draft version of the
RHEL7 STIG at the time of installation by choosing a security policy, as illustrated below. This policy does some of the "heavy lifting" in
STIG configuration, but one would still need to verify that all
STIG settings have been applied.
There are also other applicable STIGs, one for the Web server and one for the Web application. A database STIG may also apply.