content_image/697858.jpg content_image/697859.jpg
•At runtime, the OpenSSL library and OpenSSL FIPS Object Module must be available as shared (dynamically linked) objects. It is possible to build statically linked OpenSSL objects, but MySQL cannot use them. 

FIPS mode has been tested for MySQL on EL7, but may work on other systems. 

If your platform or operating system provides the OpenSSL FIPS Object Module, you can use it. Otherwise, you can build the OpenSSL library and FIPS Object Module from source. Use the instructions in the OpenSSL FIPS User Guide (see FIPS Overview). 

## Configuring FIPS Mode in MySQL 

MySQL enables control of FIPS mode on the server side and the client side: 

•The ssl_fips_mode  system variable controls whether the server operates in FIPS mode. 

•The --ssl-fips-mode  client option controls whether a given MySQL client operates in FIPS mode. 

The ssl_fips_mode  system variable and --ssl-fips-mode  client option permit these values: 

• OFF : Disable FIPS mode. 

• ON : Enable FIPS mode. 

• STRICT : Enable “strict”  FIPS mode. 

On the server side, numeric ssl_fips_mode  values of 0, 1, and 2 are equivalent to OFF , ON , and STRICT , respectivey. 

<img src='content_image/697858.jpg'>

<img src='content_image/697859.jpg'>

## Important 

In general, STRICT  imposes more restrictions than ON , but MySQL itself has no FIPS-specific code other than to specify to OpenSSL the FIPS mode value. The exact behavior of FIPS mode for ON  or STRICT  depends on the OpenSSL version. For details, refer to the OpenSSL FIPS User Guide (see FIPS Overview). 

## Note 

If the OpenSSL FIPS Object Module is not available, the only permitted value for ssl_fips_mode  and --ssl-fips-mode  is OFF . An error occurs for attempts to set the FIPS mode to a different value. 

FIPS mode on the server side applies to cryptographic operations performed by the server. This includes replication (source/replica and Group Replication) and X Plugin, which run within the server. 

FIPS mode also applies to attempts by clients to connect to the server. When enabled, on either the client or server side, it restricts which of the supported encryption ciphers can be chosen. However, enabling FIPS mode does not require that an encrypted connection must be used, or that user credentials must be encrypted. For example, if FIPS mode is enabled, stronger cryptographic algorithms are required. In particular, MD5 is restricted, so trying to establish an encrypted connection using an encryption cipher such as RC4-MD5  does not work. But there is nothing about FIPS mode that prevents establishing an unencrypted connection. (To do that, you can use the REQUIRE  clause for CREATE USER  or ALTER USER  for specific user accounts, or set the require_secure_transport  system variable to affect all accounts.) 

