From: Pauli <pauli@openssl.org>
Date: Wed, 5 Jul 2023 09:02:02 +0000 (+1000)
Subject: fips: make installations FIPS compliant by default
X-Git-Tag: openssl-3.1.2~39
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5bf944cd03208e131bfe61208271cd280d06edd0;p=thirdparty%2Fopenssl.git

fips: make installations FIPS compliant by default

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/21363)

(cherry picked from commit dc6f3b9b8d6e54ea7d8669a158fd73b451862c7d)
---

diff --git a/util/mk-fipsmodule-cnf.pl b/util/mk-fipsmodule-cnf.pl
index ac4df54c95b..3eb397adad5 100644
--- a/util/mk-fipsmodule-cnf.pl
+++ b/util/mk-fipsmodule-cnf.pl
@@ -12,8 +12,8 @@ use Getopt::Long;
 # self_test_onload happens if install_mac isn't included, don't add it below
 my $conditional_errors = 1;
 my $security_checks = 1;
-my $ems_check = 0;
-my $drgb_no_trunc_dgst = 0;
+my $ems_check = 1;
+my $drgb_no_trunc_dgst = 1;
 
 my $activate = 1;
 my $mac_key;