FIPS Support on MySQL

General

MySQL 8.0 supports FIPS mode.

MySQL versions before 8.0 don't support FIPS mode.

FIPS mode is enabled by the "ssl_fips_mode" server property (see below).

FIPS mode on the server side applies to cryptographic operations performed by the server. This includes replication and X Plugin, which run within the server.

FIPS mode also applies to attempts by clients to connect to the server.

MySQL supports FIPS mode if compiled using OpenSSL, and an OpenSSL library and FIPS Object Module are available at runtime.

If OpenSSL will not fit the FIPS requirements, an error message will be received: "Error Code: 11272. SSL fips mode error: Openssl is not fips enabled".

System Requirements and other configurations from dev.mysql.com: https://dev.mysql.com/doc/refman/8.0/en/fips-mode.html

ssl_fips_mode

ssl_fips_mode property controls whether to enable FIPS mode on the server side.

show global variables like '%ssl_fips_mode%';

ssl_fips_mode values:

Value number	Value	Meaning	Comments
0	OFF	Disable FIPS mode	"Off" is the default value of ssl_fips_mode.
1	ON	Enable FIPS mode
2	STRICT	Enable “strict” FIPS mode	In general, STRICT imposes more restrictions than ON, but MySQL itself has no FIPS-specific code other than to specify to OpenSSL the FIPS mode value. The exact behavior of FIPS mode for ON or STRICT depends on the OpenSSL version.

Enable FIPS mode:

set global ssl_fips_mode=1;