Hello David,
thanks for reporting back. Just for the archives, the code change mentioned below was also integrated in git master.
Cheers,
Henning
From: David Cunningham via sr-users <sr-users@lists.kamailio.org>
Sent: Mittwoch, 4. September 2024 01:41
To: Kamailio (SER) - Users Mailing List <sr-users@lists.kamailio.org>
Cc: David Cunningham <dcunningham@voisonics.com>
Subject: [SR-Users] Re: Using a different OpenSSL
Hi everyone,
Just sharing that the solution was to add these two lines to the [Service] section of the systemd unit file:
Environment=LD_LIBRARY_PATH=/opt/openssl/lib64
Environment=OPENSSL_CONF=/etc/ssl/fips.cnf
And also apply a patch to Kamailio in src/modules/tls/tls_mod.c so that it logs the OpenSSL library at run-time, as well as the default logging of the OpenSSL library at compilation:
448c448,461
< LM_INFO("use OpenSSL version: %08x\n", (uint32_t)(OPENSSL_VERSION_NUMBER));
---
>
> #if OPENSSL_VERSION_NUMBER < 0x030000000L
> LM_INFO("compiled with OpenSSL version: %08x\n", (uint32_t)(OPENSSL_VERSION_NUMBER));
> #elif OPENSSL_VERSION_NUMBER >= 0x030000000L
> LM_INFO("compiled with OpenSSL: %s\n", OPENSSL_VERSION_TEXT);
> LM_INFO("run-time OpenSSL library: %s\n", OpenSSL_version(OPENSSL_VERSION));
>
> if(EVP_default_properties_is_fips_enabled(NULL) == 1) {
> LM_INFO("FIPS mode enabled in OpenSSL library\n");
> } else {
> LM_INFO("FIPS mode not enabled in OpenSSL library\n");
> }
> #endif
>
Tested with Kamailio 5.8.2. Hope this helps.
On Tue, 27 Aug 2024 at 12:01, David Cunningham <dcunningham@voisonics.com> wrote: