View a markdown version of this page

Swap OpenSSL FIPS providers on AL2027 - Amazon Linux 2027
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Swap OpenSSL FIPS providers on AL2027

AL2027 Preview

AL2027 is currently available for preview. It is intended for evaluation and testing only and is not recommended for production workloads.

This section explains how to switch between the latest and certified OpenSSL FIPS providers on AL2027.

For more information about FIPS, see:

Important

On AL2027 the default OpenSSL FIPS provider is the openssl-fips-provider-latest package, which receives regular bugfix and security updates.

The instructions below are only for customers who want to pin to the openssl-fips-provider-certified package. This version of the FIPS provider will match the checksum on the NIST certificate, and may not have the latest updates.

See the AL2027 FAQ for more information about FIPS certified modules and package versions.

Note

The initial version of the openssl-fips-provider-certified package on AL2027 contains the certified FIPS provider from AL2023 (certificate #5438). See also: Amazon Linux 2023 FAQs

Prerequisites

  • An existing AL2027 Amazon EC2 instance with access to the internet to download required packages.

  • You must connect to your Amazon EC2 instance using SSH or Amazon Systems Manager.

  • To enable FIPS mode on AL2027, follow the instructions at Enable FIPS Mode on AL2027.

Switch between openssl-fips-provider-latest and openssl-fips-provider-certified

  1. Use dnf to switch the OpenSSL FIPS provider:

    sudo dnf -y swap openssl-fips-provider-latest openssl-fips-provider-certified

  2. Check that you are using the certified OpenSSL FIPS provider. With AL2027 in FIPS mode, run the following command:

    openssl list -providers

    You should see the following output:

    Providers:
  base
    name: OpenSSL Base Provider
    version: 3.5.7
    status: active
  default
    name: OpenSSL Default Provider
    version: 3.5.7
    status: active
  fips
    name: Amazon Linux 2023 - OpenSSL FIPS Provider
    version: 3.2.2-799901ad7ab41d45
    status: active