Restrict the Arm 'LDR REG, =VALUE' pseudo instruction on Neon, to appease clang

[openssl.git] / README-FIPS.md

diff --git a/README-FIPS.md b/README-FIPS.md
index a8be9ddb317f1b8affe6d00f0816441e01cfe9a9..e9c81e2c2ce3df78368782688c6115b87c0bc28b 100644 (file)
--- a/README-FIPS.md
+++ b/README-FIPS.md
@@ -1,13 +1,29 @@
 OpenSSL FIPS support
 ====================
 
-This release of OpenSSL includes a cryptographic module that is intended to be
+This release of OpenSSL includes a cryptographic module that can be
 FIPS 140-2 validated. The module is implemented as an OpenSSL provider.
 A provider is essentially a dynamically loadable module which implements
 cryptographic algorithms, see the [README-PROVIDERS](README-PROVIDERS.md) file
 for further details.
 
-The OpenSSL FIPS provider comes as shared library called `fips.so` (on Unix)
+A cryptographic module is only FIPS validated after it has gone through the complex
+FIPS 140 validation process. As this process takes a very long time, it is not
+possible to validate every minor release of OpenSSL.
+If you need a FIPS validated module then you must ONLY generate a FIPS provider
+using OpenSSL versions that have valid FIPS certificates. A FIPS certificate
+contains a link to a Security Policy, and you MUST follow the instructions
+in the Security Policy in order to be FIPS compliant.
+See <https://www.openssl.org/source/> for information related to OpenSSL
+FIPS certificates and Security Policies.
+
+Newer OpenSSL Releases that include security or bug fixes can be used to build
+all other components (such as the core API's, TLS and the default, base and
+legacy providers) without any restrictions, but the FIPS provider must be built
+as specified in the Security Policy (normally with a different version of the
+source code).
+
+The OpenSSL FIPS provider is a shared library called `fips.so` (on Unix), or
 resp. `fips.dll` (on Windows). The FIPS provider does not get built and
 installed automatically. To enable it, you need to configure OpenSSL using
 the `enable-fips` option.
@@ -15,6 +31,9 @@ the `enable-fips` option.
 Installing the FIPS module
 ==========================
 
+The following is only a guide.
+Please read the Security Policy for up to date installation instructions.
+
 If the FIPS provider is enabled, it gets installed automatically during the
 normal installation process. Simply follow the normal procedure (configure,
 make, make test, make install) as described in the [INSTALL](INSTALL.md) file.
@@ -50,7 +69,7 @@ The FIPS module must have the self tests run, and the FIPS module config file
 output generated on every machine that it is to be used on. You must not copy
 the FIPS module config file output data from one machine to another.
 
-On Unix the `openssl fipsinstall` command will be invoked as follows by default:
+On Unix, the `openssl fipsinstall` command will be invoked as follows by default:
 
     $ openssl fipsinstall -out /usr/local/ssl/fipsmodule.cnf -module /usr/local/lib/ossl-modules/fips.so