FIPS Module Support Policy

FIPS validated cryptography is delivered by the OpenSSL Library FIPS provider (the “module”), which is validated independently of the OpenSSL Library. A validated module is built from the source of the release it was validated against. It may be used, unchanged, together with a library built from any supported OpenSSL Library release from version 3.0 onwards: provider compatibility is maintained backward and forward across these releases, including future major release series, for as long as the module remains supported. The support status of an OpenSSL Library release version and the support status of an OpenSSL Library FIPS module are therefore distinct: a module can remain supported after its OpenSSL Library release version has reached end of life.

See the FIPS module guide, fips_module(7), and README-FIPS.md, which is included in every OpenSSL Library source distribution.

Every OpenSSL Library FIPS module holding an active NIST CMVP certificate is supported for the lifetime of that certificate, up to the certificate’s end date, regardless of the support status of the OpenSSL Library release version it was built from.

Section 1.Assessment

The OpenSSL Corporation ensures every OpenSSL Library security issue (CVE) is assessed for impact within the module’s validated boundary.

Section 2.Disclosure

The assessment is disclosed publicly, to everyone, with or without a support agreement. Security advisories state FIPS module impact explicitly, affected or not affected with the reason, for every module version holding an active NIST CMVP validation, including modules whose OpenSSL Library release version has reached end of life. The FIPS and CVEs page lists every CVE affecting a validated module, including those on end-of-life OpenSSL Library versions, whether or not a fixed release exists at the time of publication.

Section 3.Maintenance releases

The OpenSSL Corporation produces maintenance source releases containing the relevant fixes. The decision to produce a maintenance release, including its timing and which accumulated fixes it carries, is made at the discretion of the OpenSSL Corporation.

Section 4.Certificate updates

The OpenSSL Corporation pursues certificate updates via the CMVP CVE re-validation path, at its discretion, adding the fixed module version to the existing certificate while keeping previously validated versions valid wherever possible.

Section 5.End of support

Support for a module ends on its certificate’s end date. This is a fixed calendar date, not subject to extension under this policy. For certificate #4985 (FIPS provider 3.1.2), the end date is 10 March 2030. The currently validated modules and their certificate end dates are published on the FIPS and CVEs page and in the NIST CMVP database.

Section 1.End-of-life versions

OpenSSL Library release versions that have reached end of life are not maintained in the public source trees, and maintenance releases for them are not published publicly. These versions are not recommended for use beyond the end of life date.

Section 2.Delivery to support customers

Maintenance source releases for FIPS modules on end-of-life OpenSSL Library versions (for example, OpenSSL 3.1.9 for the 3.1.2 module) are available to customers with an active support agreement at the Engineering or Enterprise level, delivered through the Support Portal. Per-CVE patchsets against a validated module version are available on request. These deliverables exist for the maintenance of the FIPS module; they do not constitute extended support for the library version itself.

Section 3.Security pre-notification

Support customers receive embargoed pre-notification of upcoming security releases, including draft advisories and patches ahead of public disclosure, subject to the confidentiality terms of each notification.

Section 4.Versioning

Version numbering continues the upstream sequence, and the FIPS module version matches the release it is built from. The OpenSSL Library does not have separate FIPS-only branches: the FIPS module is contained within the main OpenSSL Library release.

This policy covers only code within the OpenSSL Library FIPS module boundary. The base OpenSSL library (code outside the boundary) must be built from a supported release train, publicly supported or covered by a support agreement, to receive security fixes and other improvements. Use of an end-of-life OpenSSL Library version is not covered by this policy; availability of a module maintenance release does not constitute extended support.

Updates to an OpenSSL Library FIPS base certificate do not automatically propagate to certificates derived from it by rebranding. When the OpenSSL Corporation updates a base certificate, holders of derived certificates may have the corresponding update applied to theirs:

• Enterprise level: rebranded-certificate updates are included.
• Engineering level: one rebranded-certificate action, a new rebrand or an update of an existing rebranded certificate, is included per contract year; additional actions are available at cost.

Other changes to a rebranded certificate (additional operating environments and similar) remain the customer’s responsibility under the existing rebranding terms.

The OpenSSL Corporation funds the validation of every OpenSSL Library minor release, including non-LTS releases, with the goal of keeping at least two validated modules overlapping at all times, so customers always have a validated target to move to. The 3.1.2 module is governed by this policy until certificate #4985 reaches its end date on 10 March 2030.

This page implements the OpenSSL Library FIPS Module Support Policy. For the project-level commitment, the project policy governs; for the delivery of services described here, the applicable support agreement governs.