<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h2 class="title">
      <a name="fips-mode">
      </a>
      8.8 FIPS Support
     </h2>
    </div>
   </div>
  </div>
  <a class="indexterm" name="idm46045231474144">
  </a>
  <a class="indexterm" name="idm46045231473072">
  </a>
  <a class="indexterm" name="idm46045231471584">
  </a>
  <p>
   MySQL supports FIPS mode when a supported OpenSSL library and FIPS
      Object Module are available on the host system.
  </p>
  <p>
   FIPS mode on the server side applies to cryptographic operations
      performed by the server. This includes replication (source/replica
      and Group Replication) and X Plugin, which run within the server.
      FIPS mode also applies to attempts by clients to connect to the
      server.
  </p>
  <p>
   The following sections describe FIPS mode and how to take
      advantage of it within MySQL:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <a class="xref" href="fips-mode.html#fips-overview" title="FIPS Overview">
       FIPS Overview
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="fips-mode.html#fips-system-requirements" title="System Requirements for FIPS Mode in MySQL">
       System Requirements for FIPS Mode in MySQL
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="fips-mode.html#fips-enabling" title="Enabling FIPS Mode in MySQL">
       Enabling FIPS Mode in MySQL
      </a>
     </p>
    </li>
   </ul>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h3 class="title">
       <a name="fips-overview">
       </a>
       FIPS Overview
      </h3>
     </div>
    </div>
   </div>
   <p>
    Federal Information Processing Standards 140-2 (FIPS 140-2)
        describes a security standard that can be required by Federal
        (US Government) agencies for cryptographic modules used to
        protect sensitive or valuable information. To be considered
        acceptable for such Federal use, a cryptographic module must be
        certified for FIPS 140-2. If a system intended to protect
        sensitive data lacks the proper FIPS 140-2 certificate, Federal
        agencies cannot purchase it.
   </p>
   <p>
    Products such as OpenSSL can be used in FIPS mode, although the
        OpenSSL library itself is not validated for FIPS. Instead, the
        OpenSSL library is used with the OpenSSL FIPS Object Module to
        enable OpenSSL-based applications to operate in FIPS mode.
   </p>
   <p>
    For general information about FIPS and its implementation in
        OpenSSL, these references may be helpful:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <a class="ulink" href="https://doi.org/10.6028/NIST.FIPS.140-2" target="_blank">
        National
            Institute of Standards and Technology FIPS PUB 140-2
       </a>
      </p>
     </li>
     <li class="listitem">
      <p>
       <a class="ulink" href="https://csrc.nist.gov/csrc/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp1747.pdf" target="_blank">
        OpenSSL
            FIPS 140-2 Security Policy
       </a>
      </p>
     </li>
     <li class="listitem">
      <p>
       <a class="ulink" href="https://www.openssl.org/docs/man3.0/man7/fips_module.html" target="_blank">
        fips_module
            manual page
       </a>
      </p>
     </li>
    </ul>
   </div>
   <div class="important" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Important
    </div>
    <p>
     FIPS mode imposes conditions on cryptographic operations such
          as restrictions on acceptable encryption algorithms or
          requirements for longer key lengths. For OpenSSL, the exact
          FIPS behavior depends on the OpenSSL version.
    </p>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h3 class="title">
       <a name="fips-system-requirements">
       </a>
       System Requirements for FIPS Mode in MySQL
      </h3>
     </div>
    </div>
   </div>
   <p>
    For MySQL to support FIPS mode, these system requirements must
        be satisfied:
   </p>
   <div class="orderedlist">
    <ol class="orderedlist" type="1">
     <li class="listitem">
      <p>
       MySQL must be compiled with an OpenSSL version that is
            certified for use with FIPS. OpenSSL 1.0.2 and OpenSSL 3.0
            are certified, but OpenSSL 1.1.1 is not. Binary
            distributions for recent versions of MySQL are compiled
            using OpenSSL 3.0 on some platforms, which means they are
            not certified for FIPS. This means you have the following
            options, depending on system and MySQL configuration:
      </p>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: disc; ">
        <li class="listitem">
         <p>
          Use a system that has OpenSSL 3.0 and the required FIPS
                object module. In this case, you can enable FIPS mode
                for MySQL if you use a binary distribution compiled
                using OpenSSL 3.0, or compile MySQL from source using
                OpenSSL 3.0.
         </p>
         <p>
          For general information about upgrading to OpenSSL 3.0,
                see
          <a class="ulink" href="https://www.openssl.org/docs/man3.0/man7/migration_guide.html" target="_blank">
           OpenSSL
                3.0 Migration Guide
          </a>
          .
         </p>
        </li>
        <li class="listitem">
         <p>
          Use a system that has OpenSSL 1.1.1 or higher. In this
                case, you can install MySQL using binary packages, and
                you can use the TLS v1.3 protocol and ciphersuites, in
                addition to other already supported TLS protocols.
                However, you cannot enable FIPS mode for MySQL.
         </p>
        </li>
        <li class="listitem">
         <p>
          Use a system that has OpenSSL 1.0.2 and the required
                FIPS Object Module. In this case, you can enable FIPS
                mode for MySQL if you use a binary distribution compiled
                using OpenSSL 1.0.2, or compile MySQL from source using
                OpenSSL 1.0.2. In this case, you cannot use the TLS v1.3
                protocol or ciphersuites, which require OpenSSL 1.1.1 or
                3.0. In addition, you should be aware that OpenSSL 1.0.2
                reached end of life status in 2019, and that all
                operating platforms embedding OpenSSL 1.1.1 reach their
                end of life in 2024.
         </p>
        </li>
       </ul>
      </div>
     </li>
     <li class="listitem">
      <p>
       At runtime, the OpenSSL library and OpenSSL FIPS Object
            Module must be available as shared (dynamically linked)
            objects.
      </p>
     </li>
    </ol>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h3 class="title">
       <a name="fips-enabling">
       </a>
       Enabling FIPS Mode in MySQL
      </h3>
     </div>
    </div>
   </div>
   <p>
    To determine whether MySQL is running on a system with FIPS mode
        enabled, check the value of the
    <a class="link" href="server-system-variables.html#sysvar_ssl_fips_mode">
     <code class="literal">
      ssl_fips_mode
     </code>
    </a>
    server system
        variable using an SQL statement such as
    <a class="link" href="show-variables.html" title="15.7.7.41 SHOW VARIABLES Statement">
     <code class="literal">
      SHOW VARIABLES
        LIKE '%fips%'
     </code>
    </a>
    or
    <a class="link" href="select.html" title="15.2.13 SELECT Statement">
     <code class="literal">
      SELECT
        @@ssl_fips_mode
     </code>
    </a>
    . If the value of this variable is 1
        (
    <code class="literal">
     ON
    </code>
    ) or 2 (
    <code class="literal">
     STRICT
    </code>
    ), FIPS
        mode is enabled for OpenSSL; if it is 0
        (
    <code class="literal">
     OFF
    </code>
    ), FIPS mode is not available.
   </p>
   <div class="important" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Important
    </div>
    <p>
     In general,
     <code class="literal">
      STRICT
     </code>
     imposes more
          restrictions than
     <code class="literal">
      ON
     </code>
     , but MySQL itself has
          no FIPS-specific code other than to specify the FIPS mode
          value to OpenSSL. The exact behavior of FIPS mode for
     <code class="literal">
      ON
     </code>
     or
     <code class="literal">
      STRICT
     </code>
     depends on
          the OpenSSL version. For details, refer to the
     <code class="literal">
      fips_module
     </code>
     manpage (see
     <a class="xref" href="fips-mode.html#fips-overview" title="FIPS Overview">
      FIPS Overview
     </a>
     ).
    </p>
   </div>
   <p>
    FIPS mode on the server side applies to cryptographic operations
        performed by the server, including those performed by MySQL
        Replication (including Group Replication) and X Plugin, which
        run within the server.
   </p>
   <p>
    FIPS mode also applies to attempts by clients to connect to the
        server. When enabled, on either the client or server side, it
        restricts which of the supported encryption ciphers can be
        chosen. However, enabling FIPS mode does not require that an
        encrypted connection must be used, or that user credentials must
        be encrypted. For example, if FIPS mode is enabled, stronger
        cryptographic algorithms are required. In particular, MD5 is
        restricted, so trying to establish an encrypted connection using
        an encryption cipher such as
    <code class="literal">
     RC4-MD5
    </code>
    does not
        work. But there is nothing about FIPS mode that prevents
        establishing an unencrypted connection. (To do that, you can use
        the
    <code class="literal">
     REQUIRE
    </code>
    clause for
    <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
     <code class="literal">
      CREATE USER
     </code>
    </a>
    or
    <a class="link" href="alter-user.html" title="15.7.1.1 ALTER USER Statement">
     <code class="literal">
      ALTER USER
     </code>
    </a>
    for specific user
        accounts, or set the
    <a class="link" href="server-system-variables.html#sysvar_require_secure_transport">
     <code class="literal">
      require_secure_transport
     </code>
    </a>
    system
        variable to affect all accounts.)
   </p>
   <p>
    If FIPS mode is required, it is recommended to use an operating
        platforms that includes it; if it does, you can (and should) use
        it. If your platform does not include FIPS, you have two
        options:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Migrate to a platform which has FIPS OpenSSL support.
      </p>
     </li>
     <li class="listitem">
      <p>
       Build the OpenSSL library and FIPS object module from
            source, using the instructions from
            the
       <code class="literal">
        fips_module
       </code>
       manpage
            (see
       <a class="xref" href="fips-mode.html#fips-overview" title="FIPS Overview">
        FIPS Overview
       </a>
       ).
      </p>
     </li>
    </ul>
   </div>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     If the OpenSSL FIPS Object Module is not available, the only
          permitted value for
     <a class="link" href="server-system-variables.html#sysvar_ssl_fips_mode">
      <code class="literal">
       ssl_fips_mode
      </code>
     </a>
     and
     <a class="link" href="connection-options.html#option_general_ssl-fips-mode">
      <code class="option">
       --ssl-fips-mode
      </code>
     </a>
     is
     <code class="literal">
      OFF
     </code>
     . An error occurs for attempts to set
          the FIPS mode to a different value.
    </p>
   </div>
   <p>
    If FIPS mode is required, it is recommended to use an operating
        platform that includes it; if it does, you can (and should) use
        it. If your platform does not include FIPS, you have two
        options:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Migrate to a platform which has FIPS OpenSSL support.
      </p>
     </li>
     <li class="listitem">
      <p>
       Build the OpenSSL library and FIPS object module from
            source, using the instructions from
            the
       <code class="literal">
        fips_module
       </code>
       manpage
            (see
       <a class="xref" href="fips-mode.html#fips-overview" title="FIPS Overview">
        FIPS Overview
       </a>
       ).
      </p>
     </li>
    </ul>
   </div>
  </div>
 </div>
 <br/>
</div>
