## 6.8 FIPS Support

[]()[]()[]()

 MySQL supports FIPS mode, if compiled using OpenSSL 1.0.2, and an OpenSSL library and FIPS Object Module are available at runtime.

 FIPS mode on the server side applies to cryptographic operations performed by the server. This includes replication (source/replica and Group Replication) and X Plugin, which run within the server. FIPS mode also applies to attempts by clients to connect to the server.

 The following sections describe FIPS mode and how to take advantage of it within MySQL:

* [FIPS Overview](fips-mode.html#fips-overview)

* [System Requirements for FIPS Mode in MySQL](fips-mode.html#fips-system-requirements)

* [Configuring FIPS Mode in MySQL](fips-mode.html#fips-configuration)

### FIPS Overview

 Federal Information Processing Standards 140-2 (FIPS 140-2) describes a security standard that can be required by Federal (US Government) agencies for cryptographic modules used to protect sensitive or valuable information. To be considered acceptable for such Federal use, a cryptographic module must be certified for FIPS 140-2. If a system intended to protect sensitive data lacks the proper FIPS 140-2 certificate, Federal agencies cannot purchase it.

 Products such as OpenSSL can be used in FIPS mode, although the OpenSSL library itself is not validated for FIPS. Instead, the OpenSSL library is used with the OpenSSL FIPS Object Module to enable OpenSSL-based applications to operate in FIPS mode.

 For general information about FIPS and its implementation in OpenSSL, these references may be helpful:

* [National Institute of Standards and Technology FIPS PUB 140-2](https://doi.org/10.6028/NIST.FIPS.140-2)

* [OpenSSL FIPS 140-2 Security Policy](https://www.openssl.org/docs/fips/)

* [User Guide for the OpenSSL FIPS Object Module v2.0](https://www.openssl.org/docs/fips/UserGuide-2.0.pdf)

Important

 FIPS mode imposes conditions on cryptographic operations such as restrictions on acceptable encryption algorithms or requirements for longer key lengths. For OpenSSL, the exact FIPS behavior depends on the OpenSSL version. For details, refer to the OpenSSL FIPS User Guide.

### System Requirements for FIPS Mode in MySQL

 For MySQL to support FIPS mode, these system requirements must be satisfied:

* At build time, MySQL must be compiled using OpenSSL. FIPS mode cannot be used in MySQL if compilation uses an SSL library different from OpenSSL.

   In addition, MySQL must be compiled with an OpenSSL version that is certified for use with FIPS. OpenSSL 1.0.2 is certified, but OpenSSL 1.1.1 is not. Binary distributions for recent versions of MySQL are compiled using OpenSSL 1.1.1 on some platforms, which means they are not certified for FIPS. This leads to tradeoffs in available MySQL features, depending on system and MySQL configuration:

  * Use a system that has OpenSSL 1.0.2 and the required FIPS Object Module. In this case, you can enable FIPS mode for MySQL if you use a binary distribution compiled using OpenSSL 1.0.2, or compile MySQL from source using OpenSSL 1.0.2. However, in this case, you cannot use the TLSv1.3 protocol or ciphersuites (which require OpenSSL 1.1.1). In addition, you are using an OpenSSL version that reached End of Life status at the end of 2019.

  * Use a system that has OpenSSL 1.1.1 or higher. In this case, you can install MySQL using binary packages, and you can use the TLSv1.3 protocol and ciphersuites, in addition to other already supported TLS protocols. However, you cannot enable FIPS mode for MySQL.

* At runtime, the OpenSSL library and OpenSSL FIPS Object Module must be available as shared (dynamically linked) objects. It is possible to build statically linked OpenSSL objects, but MySQL cannot use them.

 FIPS mode has been tested for MySQL on EL7, but may work on other systems.

 If your platform or operating system provides the OpenSSL FIPS Object Module, you can use it. Otherwise, you can build the OpenSSL library and FIPS Object Module from source. Use the instructions in the OpenSSL FIPS User Guide (see [FIPS Overview](fips-mode.html#fips-overview)).

### Configuring FIPS Mode in MySQL

 MySQL enables control of FIPS mode on the server side and the client side:

* The [`ssl_fips_mode`](server-system-variables.html#sysvar_ssl_fips_mode) system variable controls whether the server operates in FIPS mode.

* The [`--ssl-fips-mode`](connection-options.html#option_general_ssl-fips-mode) client option controls whether a given MySQL client operates in FIPS mode.

 The [`ssl_fips_mode`](server-system-variables.html#sysvar_ssl_fips_mode) system variable and [`--ssl-fips-mode`](connection-options.html#option_general_ssl-fips-mode) client option permit these values:

* `OFF`: Disable FIPS mode.

* `ON`: Enable FIPS mode.

* `STRICT`: Enable “strict” FIPS mode.

 On the server side, numeric [`ssl_fips_mode`](server-system-variables.html#sysvar_ssl_fips_mode) values of 0, 1, and 2 are equivalent to `OFF`, `ON`, and `STRICT`, respectivey.

Important

 In general, `STRICT` imposes more restrictions than `ON`, but MySQL itself has no FIPS-specific code other than to specify to OpenSSL the FIPS mode value. The exact behavior of FIPS mode for `ON` or `STRICT` depends on the OpenSSL version. For details, refer to the OpenSSL FIPS User Guide (see [FIPS Overview](fips-mode.html#fips-overview)).

Note

 If the OpenSSL FIPS Object Module is not available, the only permitted value for [`ssl_fips_mode`](server-system-variables.html#sysvar_ssl_fips_mode) and [`--ssl-fips-mode`](connection-options.html#option_general_ssl-fips-mode) is `OFF`. An error occurs for attempts to set the FIPS mode to a different value.

 FIPS mode on the server side applies to cryptographic operations performed by the server. This includes replication (source/replica and Group Replication) and X Plugin, which run within the server.

 FIPS mode also applies to attempts by clients to connect to the server. When enabled, on either the client or server side, it restricts which of the supported encryption ciphers can be chosen. However, enabling FIPS mode does not require that an encrypted connection must be used, or that user credentials must be encrypted. For example, if FIPS mode is enabled, stronger cryptographic algorithms are required. In particular, MD5 is restricted, so trying to establish an encrypted connection using an encryption cipher such as `RC4-MD5` does not work. But there is nothing about FIPS mode that prevents establishing an unencrypted connection. (To do that, you can use the `REQUIRE` clause for [`CREATE USER`](create-user.html) or [`ALTER USER`](alter-user.html) for specific user accounts, or set the [`require_secure_transport`](server-system-variables.html#sysvar_require_secure_transport) system variable to affect all accounts.)

