pg.ddx.io pgsql-general@postgresql.org mailing list archive
help / color / mirror / Atom feedPostgreSQL 18 FIPS mode in Windows
9+ messages / 4 participants
[nested] [flat]
* PostgreSQL 18 FIPS mode in Windows
@ 2026-09-24 20:07 sutyak <sutyak@proton.me>
2026-09-24 20:13 ` Re: PostgreSQL 18 FIPS mode in Windows Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 1 reply; 9+ messages in thread
From: sutyak @ 2026-09-24 20:07 UTC (permalink / raw)
To: pgsql-general@lists.postgresql.org <pgsql-general@lists.postgresql.org>
I have previously been compiling my own FIPS-compliant PostgreSQL and OpenSSL in Windows for FIPS compliance, but the documentation for 18 makes it sound like it is ready out of the box, and it would certainly be nice to just grab the latest off the shelf installer and use it.
The steps I have already taken are:
- Install PostgreSQL 18.6 windows-x64
- Install OpenSSL 3.5.8 with FIPS Provider 3.1.2
- Enable pgcrypto extension via pgAdmin
- set builtin_crypto_enabled to 'fips'
- Executing SELECT fips_mode(); always returns false.
- Verified FIPS is not being enforced by executing SELECT encode(digest('test', 'md5'), 'hex'); and it always returns a value.
What am I missing? Thank you,
Mark Sutyak
^ permalink raw reply [nested|flat] 9+ messages in thread
* Re: PostgreSQL 18 FIPS mode in Windows
2026-09-24 20:07 PostgreSQL 18 FIPS mode in Windows sutyak <sutyak@proton.me>
@ 2026-09-24 20:13 ` Tom Lane <tgl@sss.pgh.pa.us>
2026-09-24 20:16 ` Re: PostgreSQL 18 FIPS mode in Windows Daniel Gustafsson <daniel@yesql.se>
0 siblings, 1 reply; 9+ messages in thread
From: Tom Lane @ 2026-09-24 20:13 UTC (permalink / raw)
To: sutyak <sutyak@proton.me>; +Cc: pgsql-general@lists.postgresql.org <pgsql-general@lists.postgresql.org>
sutyak <sutyak@proton.me> writes:
> The steps I have already taken are:
> - Install PostgreSQL 18.6 windows-x64
> - Install OpenSSL 3.5.8 with FIPS Provider 3.1.2
> - Enable pgcrypto extension via pgAdmin
> - set builtin_crypto_enabled to 'fips'
> - Executing SELECT fips_mode(); always returns false.
> - Verified FIPS is not being enforced by executing SELECT encode(digest('test', 'md5'), 'hex'); and it always returns a value.
> What am I missing? Thank you,
'builtin_crypto_enabled = fips' merely tells pgcrypto to expect
failure of relevant calls. It does not cause OpenSSL to actually
go into FIPS mode. You'd have to consult the OpenSSL docs to
find out how to do that.
regards, tom lane
^ permalink raw reply [nested|flat] 9+ messages in thread
* Re: PostgreSQL 18 FIPS mode in Windows
2026-09-24 20:07 PostgreSQL 18 FIPS mode in Windows sutyak <sutyak@proton.me>
2026-09-24 20:13 ` Re: PostgreSQL 18 FIPS mode in Windows Tom Lane <tgl@sss.pgh.pa.us>
@ 2026-09-24 20:16 ` Daniel Gustafsson <daniel@yesql.se>
2026-09-24 20:53 ` Re: PostgreSQL 18 FIPS mode in Windows Joe Conway <mail@joeconway.com>
2026-09-24 20:54 ` Re: PostgreSQL 18 FIPS mode in Windows sutyak <sutyak@proton.me>
0 siblings, 2 replies; 9+ messages in thread
From: Daniel Gustafsson @ 2026-09-24 20:16 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: sutyak <sutyak@proton.me>; pgsql-general@lists.postgresql.org <pgsql-general@lists.postgresql.org>
> On 24 Sep 2026, at 22:13, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>
> sutyak <sutyak@proton.me> writes:
>> The steps I have already taken are:
>
>> - Install PostgreSQL 18.6 windows-x64
>> - Install OpenSSL 3.5.8 with FIPS Provider 3.1.2
>> - Enable pgcrypto extension via pgAdmin
>> - set builtin_crypto_enabled to 'fips'
>> - Executing SELECT fips_mode(); always returns false.
>> - Verified FIPS is not being enforced by executing SELECT encode(digest('test', 'md5'), 'hex'); and it always returns a value.
>
>> What am I missing? Thank you,
>
> 'builtin_crypto_enabled = fips' merely tells pgcrypto to expect
> failure of relevant calls. It does not cause OpenSSL to actually
> go into FIPS mode. You'd have to consult the OpenSSL docs to
> find out how to do that.
+1. You need to enable the FIPS provider in openssl.conf and make sure to
disable the legacy provider. The builtin_crypto_enabled setting simply makes
sure to never call non-FIPS certified crypto when OpenSSL is operating in fips
mode, you can also set it to 'off' and disallow non-FIPS certified crypto
regardless.
--
Daniel Gustafsson
^ permalink raw reply [nested|flat] 9+ messages in thread
* Re: PostgreSQL 18 FIPS mode in Windows
2026-09-24 20:07 PostgreSQL 18 FIPS mode in Windows sutyak <sutyak@proton.me>
2026-09-24 20:13 ` Re: PostgreSQL 18 FIPS mode in Windows Tom Lane <tgl@sss.pgh.pa.us>
2026-09-24 20:16 ` Re: PostgreSQL 18 FIPS mode in Windows Daniel Gustafsson <daniel@yesql.se>
@ 2026-09-24 20:53 ` Joe Conway <mail@joeconway.com>
1 sibling, 0 replies; 9+ messages in thread
From: Joe Conway @ 2026-09-24 20:53 UTC (permalink / raw)
To: Daniel Gustafsson <daniel@yesql.se>; Tom Lane <tgl@sss.pgh.pa.us>; +Cc: sutyak <sutyak@proton.me>; pgsql-general@lists.postgresql.org <pgsql-general@lists.postgresql.org>
On 9/24/26 16:16, Daniel Gustafsson wrote:
>> On 24 Sep 2026, at 22:13, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>>
>> sutyak <sutyak@proton.me> writes:
>>> The steps I have already taken are:
>>
>>> - Install PostgreSQL 18.6 windows-x64
>>> - Install OpenSSL 3.5.8 with FIPS Provider 3.1.2
>>> - Enable pgcrypto extension via pgAdmin
>>> - set builtin_crypto_enabled to 'fips'
>>> - Executing SELECT fips_mode(); always returns false.
>>> - Verified FIPS is not being enforced by executing SELECT encode(digest('test', 'md5'), 'hex'); and it always returns a value.
>>
>>> What am I missing? Thank you,
>>
>> 'builtin_crypto_enabled = fips' merely tells pgcrypto to expect
>> failure of relevant calls. It does not cause OpenSSL to actually
>> go into FIPS mode. You'd have to consult the OpenSSL docs to
>> find out how to do that.
>
> +1. You need to enable the FIPS provider in openssl.conf and make sure to
> disable the legacy provider. The builtin_crypto_enabled setting simply makes
> sure to never call non-FIPS certified crypto when OpenSSL is operating in fips
> mode, you can also set it to 'off' and disallow non-FIPS certified crypto
> regardless.
Also to be clear, the distributor of the openssl library used must get
their specific bits validated in order to be actually FIPS compliant if
compliance is what you are after.
--
Joe Conway
PostgreSQL Contributors Team
Amazon Web Services: https://aws.amazon.com
^ permalink raw reply [nested|flat] 9+ messages in thread
* Re: PostgreSQL 18 FIPS mode in Windows
2026-09-24 20:07 PostgreSQL 18 FIPS mode in Windows sutyak <sutyak@proton.me>
2026-09-24 20:13 ` Re: PostgreSQL 18 FIPS mode in Windows Tom Lane <tgl@sss.pgh.pa.us>
2026-09-24 20:16 ` Re: PostgreSQL 18 FIPS mode in Windows Daniel Gustafsson <daniel@yesql.se>
@ 2026-09-24 20:54 ` sutyak <sutyak@proton.me>
2026-09-24 21:48 ` Re: PostgreSQL 18 FIPS mode in Windows Daniel Gustafsson <daniel@yesql.se>
1 sibling, 1 reply; 9+ messages in thread
From: sutyak @ 2026-09-24 20:54 UTC (permalink / raw)
To: Daniel Gustafsson <daniel@yesql.se>; +Cc: Tom Lane <tgl@sss.pgh.pa.us>; pgsql-general@lists.postgresql.org <pgsql-general@lists.postgresql.org>
I forgot to mention I did ensure FIPS is the only option enabled in OpenSSL. Verified by running openssl.exe list-providers.
Mark
Sent from Proton Mail for Android.
-------- Original Message --------
On Thursday, 09/24/26 at 16:17 Daniel Gustafsson <daniel@yesql.se> wrote:
> On 24 Sep 2026, at 22:13, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>
> sutyak <sutyak@proton.me> writes:
>> The steps I have already taken are:
>
>> - Install PostgreSQL 18.6 windows-x64
>> - Install OpenSSL 3.5.8 with FIPS Provider 3.1.2
>> - Enable pgcrypto extension via pgAdmin
>> - set builtin_crypto_enabled to 'fips'
>> - Executing SELECT fips_mode(); always returns false.
>> - Verified FIPS is not being enforced by executing SELECT encode(digest('test', 'md5'), 'hex'); and it always returns a value.
>
>> What am I missing? Thank you,
>
> 'builtin_crypto_enabled = fips' merely tells pgcrypto to expect
> failure of relevant calls. It does not cause OpenSSL to actually
> go into FIPS mode. You'd have to consult the OpenSSL docs to
> find out how to do that.
+1. You need to enable the FIPS provider in openssl.conf and make sure to
disable the legacy provider. The builtin_crypto_enabled setting simply makes
sure to never call non-FIPS certified crypto when OpenSSL is operating in fips
mode, you can also set it to 'off' and disallow non-FIPS certified crypto
regardless.
--
Daniel Gustafsson
^ permalink raw reply [nested|flat] 9+ messages in thread
* Re: PostgreSQL 18 FIPS mode in Windows
2026-09-24 20:07 PostgreSQL 18 FIPS mode in Windows sutyak <sutyak@proton.me>
2026-09-24 20:13 ` Re: PostgreSQL 18 FIPS mode in Windows Tom Lane <tgl@sss.pgh.pa.us>
2026-09-24 20:16 ` Re: PostgreSQL 18 FIPS mode in Windows Daniel Gustafsson <daniel@yesql.se>
2026-09-24 20:54 ` Re: PostgreSQL 18 FIPS mode in Windows sutyak <sutyak@proton.me>
@ 2026-09-24 21:48 ` Daniel Gustafsson <daniel@yesql.se>
2026-09-24 21:58 ` Re: PostgreSQL 18 FIPS mode in Windows sutyak <sutyak@proton.me>
0 siblings, 1 reply; 9+ messages in thread
From: Daniel Gustafsson @ 2026-09-24 21:48 UTC (permalink / raw)
To: sutyak <sutyak@proton.me>; +Cc: Tom Lane <tgl@sss.pgh.pa.us>; pgsql-general@lists.postgresql.org <pgsql-general@lists.postgresql.org>
> On 24 Sep 2026, at 22:54, sutyak <sutyak@proton.me> wrote:
>
> I forgot to mention I did ensure FIPS is the only option enabled in OpenSSL. Verified by running openssl.exe list-providers.
Is that using the same configuration as the OpenSSL used by Postgres? Is it
even the same OpenSSL used by Postgres? If you are using the Windows Installer
from EDB I believe they are using a special hardcoded openssldir where the
config must reside.
--
Daniel Gustafsson
^ permalink raw reply [nested|flat] 9+ messages in thread
* Re: PostgreSQL 18 FIPS mode in Windows
2026-09-24 20:07 PostgreSQL 18 FIPS mode in Windows sutyak <sutyak@proton.me>
2026-09-24 20:13 ` Re: PostgreSQL 18 FIPS mode in Windows Tom Lane <tgl@sss.pgh.pa.us>
2026-09-24 20:16 ` Re: PostgreSQL 18 FIPS mode in Windows Daniel Gustafsson <daniel@yesql.se>
2026-09-24 20:54 ` Re: PostgreSQL 18 FIPS mode in Windows sutyak <sutyak@proton.me>
2026-09-24 21:48 ` Re: PostgreSQL 18 FIPS mode in Windows Daniel Gustafsson <daniel@yesql.se>
@ 2026-09-24 21:58 ` sutyak <sutyak@proton.me>
2026-09-24 22:08 ` Re: PostgreSQL 18 FIPS mode in Windows Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 1 reply; 9+ messages in thread
From: sutyak @ 2026-09-24 21:58 UTC (permalink / raw)
To: Daniel Gustafsson <daniel@yesql.se>; +Cc: Tom Lane <tgl@sss.pgh.pa.us>; pgsql-general@lists.postgresql.org <pgsql-general@lists.postgresql.org>
That is something I should have considered. Do you know the default PostgeSQL OpenSSL path? If not I can pull the source and see what it is there.
Mark Sutyak
Sent from Proton Mail for Android.
-------- Original Message --------
On Thursday, 09/24/26 at 17:49 Daniel Gustafsson <daniel@yesql.se> wrote:
> On 24 Sep 2026, at 22:54, sutyak <sutyak@proton.me> wrote:
>
> I forgot to mention I did ensure FIPS is the only option enabled in OpenSSL. Verified by running openssl.exe list-providers.
Is that using the same configuration as the OpenSSL used by Postgres? Is it
even the same OpenSSL used by Postgres? If you are using the Windows Installer
from EDB I believe they are using a special hardcoded openssldir where the
config must reside.
--
Daniel Gustafsson
^ permalink raw reply [nested|flat] 9+ messages in thread
* Re: PostgreSQL 18 FIPS mode in Windows
2026-09-24 20:07 PostgreSQL 18 FIPS mode in Windows sutyak <sutyak@proton.me>
2026-09-24 20:13 ` Re: PostgreSQL 18 FIPS mode in Windows Tom Lane <tgl@sss.pgh.pa.us>
2026-09-24 20:16 ` Re: PostgreSQL 18 FIPS mode in Windows Daniel Gustafsson <daniel@yesql.se>
2026-09-24 20:54 ` Re: PostgreSQL 18 FIPS mode in Windows sutyak <sutyak@proton.me>
2026-09-24 21:48 ` Re: PostgreSQL 18 FIPS mode in Windows Daniel Gustafsson <daniel@yesql.se>
2026-09-24 21:58 ` Re: PostgreSQL 18 FIPS mode in Windows sutyak <sutyak@proton.me>
@ 2026-09-24 22:08 ` Tom Lane <tgl@sss.pgh.pa.us>
2026-09-24 22:44 ` Re: PostgreSQL 18 FIPS mode in Windows sutyak <sutyak@proton.me>
0 siblings, 1 reply; 9+ messages in thread
From: Tom Lane @ 2026-09-24 22:08 UTC (permalink / raw)
To: sutyak <sutyak@proton.me>; +Cc: Daniel Gustafsson <daniel@yesql.se>; pgsql-general@lists.postgresql.org <pgsql-general@lists.postgresql.org>
sutyak <sutyak@proton.me> writes:
> That is something I should have considered. Do you know the default PostgeSQL OpenSSL path? If not I can pull the source and see what it is there.
AFAIK this question is outside the Postgres source code, and rather is
something to do with the OpenSSL that's bundled in EDB's installer.
You'd have to look at EDB's documentation.
regards, tom lane
^ permalink raw reply [nested|flat] 9+ messages in thread
* Re: PostgreSQL 18 FIPS mode in Windows
2026-09-24 20:07 PostgreSQL 18 FIPS mode in Windows sutyak <sutyak@proton.me>
2026-09-24 20:13 ` Re: PostgreSQL 18 FIPS mode in Windows Tom Lane <tgl@sss.pgh.pa.us>
2026-09-24 20:16 ` Re: PostgreSQL 18 FIPS mode in Windows Daniel Gustafsson <daniel@yesql.se>
2026-09-24 20:54 ` Re: PostgreSQL 18 FIPS mode in Windows sutyak <sutyak@proton.me>
2026-09-24 21:48 ` Re: PostgreSQL 18 FIPS mode in Windows Daniel Gustafsson <daniel@yesql.se>
2026-09-24 21:58 ` Re: PostgreSQL 18 FIPS mode in Windows sutyak <sutyak@proton.me>
2026-09-24 22:08 ` Re: PostgreSQL 18 FIPS mode in Windows Tom Lane <tgl@sss.pgh.pa.us>
@ 2026-09-24 22:44 ` sutyak <sutyak@proton.me>
0 siblings, 0 replies; 9+ messages in thread
From: sutyak @ 2026-09-24 22:44 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Daniel Gustafsson <daniel@yesql.se>; pgsql-general@lists.postgresql.org <pgsql-general@lists.postgresql.org>
Tom, I believe you are correct. Thank you all for the help.
Mark Sutyak
Sent with Proton Mail secure email.
On Thursday, September 24th, 2026 at 6:08 PM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
> sutyak <sutyak@proton.me> writes:
> > That is something I should have considered. Do you know the default PostgeSQL OpenSSL path? If not I can pull the source and see what it is there.
>
> AFAIK this question is outside the Postgres source code, and rather is
> something to do with the OpenSSL that's bundled in EDB's installer.
> You'd have to look at EDB's documentation.
>
> regards, tom lane
>
>
>
^ permalink raw reply [nested|flat] 9+ messages in thread
end of thread, other threads:[~2026-09-24 22:44 UTC | newest]
Thread overview: 9+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2026-09-24 20:07 PostgreSQL 18 FIPS mode in Windows sutyak <sutyak@proton.me>
2026-09-24 20:13 ` Tom Lane <tgl@sss.pgh.pa.us>
2026-09-24 20:16 ` Daniel Gustafsson <daniel@yesql.se>
2026-09-24 20:53 ` Joe Conway <mail@joeconway.com>
2026-09-24 20:54 ` sutyak <sutyak@proton.me>
2026-09-24 21:48 ` Daniel Gustafsson <daniel@yesql.se>
2026-09-24 21:58 ` sutyak <sutyak@proton.me>
2026-09-24 22:08 ` Tom Lane <tgl@sss.pgh.pa.us>
2026-09-24 22:44 ` sutyak <sutyak@proton.me>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox