From 08c4167790785c112357fa769b3e0f11654abd2b Mon Sep 17 00:00:00 2001
From: rpm-build <rpm-build>
Date: Wed, 6 Mar 2024 19:17:15 +0100
Subject: [PATCH 18/59] FIPS: disable fipsinstall

Patch-name: 0034.fipsinstall_disable.patch
Patch-id: 34
Patch-status: |
    # # Comment out fipsinstall command-line utility
From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce
---
 apps/fipsinstall.c                    |   3 +
 doc/man1/openssl-fipsinstall.pod.in   | 481 +-------------------------
 doc/man1/openssl.pod                  |   4 -
 doc/man5/config.pod                   |   1 -
 doc/man5/fips_config.pod              | 222 +-----------
 doc/man7/OSSL_PROVIDER-FIPS.pod       |   1 -
 test/recipes/00-prep_fipsmodule_cnf.t |  10 +-
 test/recipes/01-test_fipsmodule_cnf.t |   7 +-
 test/recipes/03-test_fipsinstall.t    |   2 +
 9 files changed, 22 insertions(+), 709 deletions(-)
 mode change 100644 => 100755 test/recipes/00-prep_fipsmodule_cnf.t
 mode change 100644 => 100755 test/recipes/01-test_fipsmodule_cnf.t
 mode change 100644 => 100755 test/recipes/03-test_fipsinstall.t

diff --git a/apps/fipsinstall.c b/apps/fipsinstall.c
index 0daa55a1b8..b4e29ac301 100644
--- a/apps/fipsinstall.c
+++ b/apps/fipsinstall.c
@@ -590,6 +590,9 @@ int fipsinstall_main(int argc, char **argv)
     EVP_MAC *mac = NULL;
     CONF *conf = NULL;
 
+    BIO_printf(bio_err, "This command is not enabled in the Red Hat Enterprise Linux OpenSSL build, please consult Red Hat documentation to learn how to enable FIPS mode\n");
+    return 1;
+
     if ((opts = sk_OPENSSL_STRING_new_null()) == NULL)
         goto end;
 
diff --git a/doc/man1/openssl-fipsinstall.pod.in b/doc/man1/openssl-fipsinstall.pod.in
index d44b4a7dac..1c6b783413 100644
--- a/doc/man1/openssl-fipsinstall.pod.in
+++ b/doc/man1/openssl-fipsinstall.pod.in
@@ -8,484 +8,9 @@ openssl-fipsinstall - perform FIPS configuration installation
 =head1 SYNOPSIS
 
 B<openssl fipsinstall>
-[B<-help>]
-[B<-in> I<configfilename>]
-[B<-out> I<configfilename>]
-[B<-module> I<modulefilename>]
-[B<-provider_name> I<providername>]
-[B<-section_name> I<sectionname>]
-[B<-verify>]
-[B<-mac_name> I<macname>]
-[B<-macopt> I<nm>:I<v>]
-[B<-noout>]
-[B<-quiet>]
-[B<-pedantic>]
-[B<-no_conditional_errors>]
-[B<-no_security_checks>]
-[B<-hmac_key_check>]
-[B<-kmac_key_check>]
-[B<-ems_check>]
-[B<-no_drbg_truncated_digests>]
-[B<-signature_digest_check>]
-[B<-hkdf_digest_check>]
-[B<-tls13_kdf_digest_check>]
-[B<-tls1_prf_digest_check>]
-[B<-sshkdf_digest_check>]
-[B<-sskdf_digest_check>]
-[B<-x963kdf_digest_check>]
-[B<-dsa_sign_disabled>]
-[B<-no_pbkdf2_lower_bound_check>]
-[B<-no_short_mac>]
-[B<-tdes_encrypt_disabled>]
-[B<-rsa_pkcs15_padding_disabled>]
-[B<-rsa_pss_saltlen_check>]
-[B<-rsa_sign_x931_disabled>]
-[B<-hkdf_key_check>]
-[B<-kbkdf_key_check>]
-[B<-tls13_kdf_key_check>]
-[B<-tls1_prf_key_check>]
-[B<-sshkdf_key_check>]
-[B<-sskdf_key_check>]
-[B<-x963kdf_key_check>]
-[B<-x942kdf_key_check>]
-[B<-ecdh_cofactor_check>]
-[B<-self_test_onload>]
-[B<-self_test_oninstall>]
-[B<-corrupt_desc> I<selftest_description>]
-[B<-corrupt_type> I<selftest_type>]
-[B<-config> I<parent_config>]
-
-=head1 DESCRIPTION
-
-This command is used to generate a FIPS module configuration file.
-This configuration file can be used each time a FIPS module is loaded
-in order to pass data to the FIPS module self tests. The FIPS module always
-verifies its MAC, but optionally only needs to run the KAT's once,
-at installation.
-
-The generated configuration file consists of:
-
-=over 4
-
-=item - A MAC of the FIPS module file.
-
-=item - A test status indicator.
-
-This indicates if the Known Answer Self Tests (KAT's) have successfully run.
-
-=item - A MAC of the status indicator.
-
-=item - A control for conditional self tests errors.
-
-By default if a continuous test (e.g a key pair test) fails then the FIPS module
-will enter an error state, and no services or cryptographic algorithms will be
-able to be accessed after this point.
-The default value of '1' will cause the fips module error state to be entered.
-If the value is '0' then the module error state will not be entered.
-Regardless of whether the error state is entered or not, the current operation
-(e.g. key generation) will return an error. The user is responsible for retrying
-the operation if the module error state is not entered.
-
-=item - A control to indicate whether run-time security checks are done.
-
-This indicates if run-time checks related to enforcement of security parameters
-such as minimum security strength of keys and approved curve names are used.
-The default value of '1' will perform the checks.
-If the value is '0' the checks are not performed and FIPS compliance must
-be done by procedures documented in the relevant Security Policy.
-
-=back
-
-This file is described in L<fips_config(5)>.
-
-=head1 OPTIONS
-
-=over 4
-
-=item B<-help>
-
-Print a usage message.
-
-=item B<-module> I<filename>
-
-Filename of the FIPS module to perform an integrity check on.
-The path provided in the filename is used to load the module when it is
-activated, and this overrides the environment variable B<OPENSSL_MODULES>.
-
-=item B<-out> I<configfilename>
-
-Filename to output the configuration data to; the default is standard output.
-
-=item B<-in> I<configfilename>
-
-Input filename to load configuration data from.
-Must be used if the B<-verify> option is specified.
-
-=item B<-verify>
-
-Verify that the input configuration file contains the correct information.
-
-=item B<-provider_name> I<providername>
-
-Name of the provider inside the configuration file.
-The default value is C<fips>.
-
-=item B<-section_name> I<sectionname>
-
-Name of the section inside the configuration file.
-The default value is C<fips_sect>.
-
-=item B<-mac_name> I<name>
-
-Specifies the name of a supported MAC algorithm which will be used.
-The MAC mechanisms that are available will depend on the options
-used when building OpenSSL.
-To see the list of supported MAC's use the command
-C<openssl list -mac-algorithms>.  The default is B<HMAC>.
-
-=item B<-macopt> I<nm>:I<v>
-
-Passes options to the MAC algorithm.
-A comprehensive list of controls can be found in the EVP_MAC implementation
-documentation.
-Common control strings used for this command are:
-
-=over 4
-
-=item B<key>:I<string>
-
-Specifies the MAC key as an alphanumeric string (use if the key contains
-printable characters only).
-The string length must conform to any restrictions of the MAC algorithm.
-A key must be specified for every MAC algorithm.
-If no key is provided, the default that was specified when OpenSSL was
-configured is used.
-
-=item B<hexkey>:I<string>
-
-Specifies the MAC key in hexadecimal form (two hex digits per byte).
-The key length must conform to any restrictions of the MAC algorithm.
-A key must be specified for every MAC algorithm.
-If no key is provided, the default that was specified when OpenSSL was
-configured is used.
-
-=item B<digest>:I<string>
-
-Used by HMAC as an alphanumeric string (use if the key contains printable
-characters only).
-The string length must conform to any restrictions of the MAC algorithm.
-To see the list of supported digests, use the command
-C<openssl list -digest-commands>.
-The default digest is SHA-256.
-
-=back
-
-=item B<-noout>
-
-Disable logging of the self tests.
-
-=item B<-pedantic>
-
-Configure the module so that it is strictly FIPS compliant rather
-than being backwards compatible.  This enables conditional errors,
-security checks etc.  Note that any previous configuration options will
-be overwritten and any subsequent configuration options that violate
-FIPS compliance will result in an error.
-
-=item B<-no_conditional_errors>
-
-Configure the module to not enter an error state if a conditional self test
-fails as described above.
-
-=item B<-no_security_checks>
-
-Configure the module to not perform run-time security checks as described above.
-
-Enabling the configuration option "no-fips-securitychecks" provides another way to
-turn off the check at compile time.
-
-=item B<-ems_check>
-
-Configure the module to enable a run-time Extended Master Secret (EMS) check
-when using the TLS1_PRF KDF algorithm. This check is disabled by default.
-See RFC 7627 for information related to EMS.
-
-=item B<-no_short_mac>
-
-Configure the module to not allow short MAC outputs.
-See SP 800-185 8.4.2 and FIPS 140-3 ID C.D for details.
-
-=item B<-hmac_key_check>
-
-Configure the module to not allow small keys sizes when using HMAC.
-See SP 800-131Ar2 for details.
-
-=item B<-kmac_key_check>
-
-Configure the module to not allow small keys sizes when using KMAC.
-See SP 800-131Ar2 for details.
-
-=item B<-no_drbg_truncated_digests>
-
-Configure the module to not allow truncated digests to be used with Hash and
-HMAC DRBGs.  See FIPS 140-3 IG D.R for details.
-
-=item B<-signature_digest_check>
-
-Configure the module to enforce signature algorithms to use digests that are
-explicitly permitted by the various standards.
-
-=item B<-hkdf_digest_check>
-
-This option is deprecated.
-
-=item B<-tls13_kdf_digest_check>
-
-Configure the module to enable a run-time digest check when deriving a key by
-TLS13 KDF.
-See RFC 8446 for details.
-
-=item B<-tls1_prf_digest_check>
-
-Configure the module to enable a run-time digest check when deriving a key by
-TLS_PRF.
-See NIST SP 800-135r1 for details.
-
-=item B<-sshkdf_digest_check>
-
-Configure the module to enable a run-time digest check when deriving a key by
-SSHKDF.
-See NIST SP 800-135r1 for details.
-
-=item B<-sskdf_digest_check>
-
-This option is deprecated.
-
-=item B<-x963kdf_digest_check>
-
-Configure the module to enable a run-time digest check when deriving a key by
-X963KDF.
-See NIST SP 800-131Ar2 for details.
-
-=item B<-dsa_sign_disabled>
-
-Configure the module to not allow DSA signing (DSA signature verification is
-still allowed). See FIPS 140-3 IG C.K for details.
-
-=item B<-tdes_encrypt_disabled>
-
-Configure the module to not allow Triple-DES encryption.
-Triple-DES decryption is still allowed for legacy purposes.
-See SP800-131Ar2 for details.
-
-=item B<-rsa_pkcs15_padding_disabled>
-
-Configure the module to not allow PKCS#1 version 1.5 padding to be used with
-RSA for key transport and key agreement.  See NIST's SP 800-131A Revision 2
-for details.
-
-=item B<-rsa_pss_saltlen_check>
-
-Configure the module to enable a run-time salt length check when generating or
-verifying a RSA-PSS signature.
-See FIPS 186-5 5.4 (g) for details.
-
-=item B<-rsa_sign_x931_disabled>
-
-Configure the module to not allow X9.31 padding to be used when signing with
-RSA.  See FIPS 140-3 IG C.K for details.
-
-=item B<-hkdf_key_check>
-
-Configure the module to enable a run-time short key-derivation key check when
-deriving a key by HKDF.
-See NIST SP 800-131Ar2 for details.
-
-=item B<-kbkdf_key_check>
-
-Configure the module to enable a run-time short key-derivation key check when
-deriving a key by KBKDF.
-See NIST SP 800-131Ar2 for details.
-
-=item B<-tls13_kdf_key_check>
-
-Configure the module to enable a run-time short key-derivation key check when
-deriving a key by TLS13 KDF.
-See NIST SP 800-131Ar2 for details.
-
-=item B<-tls1_prf_key_check>
-
-Configure the module to enable a run-time short key-derivation key check when
-deriving a key by TLS_PRF.
-See NIST SP 800-131Ar2 for details.
-
-=item B<-sshkdf_key_check>
-
-Configure the module to enable a run-time short key-derivation key check when
-deriving a key by SSHKDF.
-See NIST SP 800-131Ar2 for details.
-
-=item B<-sskdf_key_check>
-
-Configure the module to enable a run-time short key-derivation key check when
-deriving a key by SSKDF.
-See NIST SP 800-131Ar2 for details.
-
-=item B<-x963kdf_key_check>
-
-Configure the module to enable a run-time short key-derivation key check when
-deriving a key by X963KDF.
-See NIST SP 800-131Ar2 for details.
-
-=item B<-x942kdf_key_check>
-
-Configure the module to enable a run-time short key-derivation key check when
-deriving a key by X942KDF.
-See NIST SP 800-131Ar2 for details.
-
-=item B<-no_pbkdf2_lower_bound_check>
-
-Configure the module to not perform run-time lower bound check for PBKDF2.
-See NIST SP 800-132 for details.
-
-=item B<-ecdh_cofactor_check>
-
-Configure the module to enable a run-time check that ECDH uses the EC curves
-cofactor value when deriving a key. This only affects the 'B' and 'K' curves.
-See SP 800-56A r3 Section 5.7.1.2 for details.
-
-=item B<-self_test_onload>
-
-Do not write the two fields related to the "test status indicator" and
-"MAC status indicator" to the output configuration file. Without these fields
-the self tests KATS will run each time the module is loaded. This option could be
-used for cross compiling, since the self tests need to run at least once on each
-target machine. Once the self tests have run on the target machine the user
-could possibly then add the 2 fields into the configuration using some other
-mechanism.
-This option defaults to 0 for any OpenSSL FIPS 140-2 provider (OpenSSL 3.0.X).
-and is not relevant for an OpenSSL FIPS 140-3 provider, since this is no
-longer allowed.
-
-=item B<-self_test_oninstall>
-
-The converse of B<-self_test_oninstall>.  The two fields related to the
-"test status indicator" and "MAC status indicator" are written to the
-output configuration file.
-This field is not relevant for an OpenSSL FIPS 140-3 provider, since this is no
-longer allowed.
-
-=item B<-quiet>
-
-Do not output pass/fail messages. Implies B<-noout>.
-
-=item B<-corrupt_desc> I<selftest_description>,
-B<-corrupt_type> I<selftest_type>
-
-The corrupt options can be used to test failure of one or more self tests by
-name.
-Either option or both may be used to select the tests to corrupt.
-Refer to the entries for B<st-desc> and B<st-type> in L<OSSL_PROVIDER-FIPS(7)> for
-values that can be used.
-
-=item B<-config> I<parent_config>
-
-Test that a FIPS provider can be loaded from the specified configuration file.
-A previous call to this application needs to generate the extra configuration
-data that is included by the base C<parent_config> configuration file.
-See L<config(5)> for further information on how to set up a provider section.
-All other options are ignored if '-config' is used.
-
-=back
-
-=head1 NOTES
-
-Self tests results are logged by default if the options B<-quiet> and B<-noout>
-are not specified, or if either of the options B<-corrupt_desc> or
-B<-corrupt_type> are used.
-If the base configuration file is set up to autoload the fips module, then the
-fips module will be loaded and self tested BEFORE the fipsinstall application
-has a chance to set up its own self test callback. As a result of this the self
-test output and the options B<-corrupt_desc> and B<-corrupt_type> will be ignored.
-For normal usage the base configuration file should use the default provider
-when generating the fips configuration file.
-
-The B<-self_test_oninstall> option was added and the
-B<-self_test_onload> option was made the default in OpenSSL 3.1.
-
-The command and all remaining options were added in OpenSSL 3.0.
-
-=head1 EXAMPLES
-
-Calculate the mac of a FIPS module F<fips.so> and run a FIPS self test
-for the module, and save the F<fips.cnf> configuration file:
-
- openssl fipsinstall -module ./fips.so -out fips.cnf -provider_name fips
-
-Verify that the configuration file F<fips.cnf> contains the correct info:
-
- openssl fipsinstall -module ./fips.so -in fips.cnf  -provider_name fips -verify
-
-Corrupt any self tests which have the description C<SHA1>:
-
- openssl fipsinstall -module ./fips.so -out fips.cnf -provider_name fips \
-         -corrupt_desc 'SHA1'
-
-Validate that the fips module can be loaded from a base configuration file:
-
- export OPENSSL_CONF_INCLUDE=<path of configuration files>
- export OPENSSL_MODULES=<provider-path>
- openssl fipsinstall -config' 'default.cnf'
-
-
-=head1 SEE ALSO
-
-L<config(5)>,
-L<fips_config(5)>,
-L<OSSL_PROVIDER-FIPS(7)>,
-L<EVP_MAC(3)>
-
-=head1 HISTORY
-
-The B<openssl-fipsinstall> application was added in OpenSSL 3.0.
-
-The following options were added in OpenSSL 3.1:
-
-B<-ems_check>,
-B<-self_test_oninstall>
-
-The following options were added in OpenSSL 3.2:
-
-B<-pedantic>,
-B<-no_drbg_truncated_digests>
-
-The following options were added in OpenSSL 3.4:
-
-B<-hmac_key_check>,
-B<-kmac_key_check>,
-B<-signature_digest_check>,
-B<-hkdf_digest_check>,
-B<-tls13_kdf_digest_check>,
-B<-tls1_prf_digest_check>,
-B<-sshkdf_digest_check>,
-B<-sskdf_digest_check>,
-B<-x963kdf_digest_check>,
-B<-dsa_sign_disabled>,
-B<-no_pbkdf2_lower_bound_check>,
-B<-no_short_mac>,
-B<-tdes_encrypt_disabled>,
-B<-rsa_pkcs15_padding_disabled>,
-B<-rsa_pss_saltlen_check>,
-B<-rsa_sign_x931_disabled>,
-B<-hkdf_key_check>,
-B<-kbkdf_key_check>,
-B<-tls13_kdf_key_check>,
-B<-tls1_prf_key_check>,
-B<-sshkdf_key_check>,
-B<-sskdf_key_check>,
-B<-x963kdf_key_check>,
-B<-x942kdf_key_check>,
-B<-ecdh_cofactor_check>
+This command is disabled.
+Please consult Red Hat Enterprise Linux documentation to learn how to correctly
+enable FIPS mode on Red Hat Enterprise
 
 =head1 COPYRIGHT
 
diff --git a/doc/man1/openssl.pod b/doc/man1/openssl.pod
index edef2ff598..0762a00d74 100644
--- a/doc/man1/openssl.pod
+++ b/doc/man1/openssl.pod
@@ -139,10 +139,6 @@ Engine (loadable module) information and manipulation.
 
 Error Number to Error String Conversion.
 
-=item B<fipsinstall>
-
-FIPS configuration installation.
-
 =item B<gendsa>
 
 Generation of DSA Private Key from Parameters. Superseded by
diff --git a/doc/man5/config.pod b/doc/man5/config.pod
index b994081924..7a6d7fab4a 100644
--- a/doc/man5/config.pod
+++ b/doc/man5/config.pod
@@ -603,7 +603,6 @@ configuration files using that syntax will have to be modified.
 =head1 SEE ALSO
 
 L<openssl-x509(1)>, L<openssl-req(1)>, L<openssl-ca(1)>,
-L<openssl-fipsinstall(1)>,
 L<ASN1_generate_nconf(3)>,
 L<EVP_set_default_properties(3)>,
 L<CONF_modules_load(3)>,
diff --git a/doc/man5/fips_config.pod b/doc/man5/fips_config.pod
index c3f7b8f3ab..2505938c13 100644
--- a/doc/man5/fips_config.pod
+++ b/doc/man5/fips_config.pod
@@ -6,224 +6,10 @@ fips_config - OpenSSL FIPS configuration
 
 =head1 DESCRIPTION
 
-A separate configuration file, using the OpenSSL L<config(5)> syntax,
-is used to hold information about the FIPS module. This includes a digest
-of the shared library file, and status about the self-testing.
-This data is used automatically by the module itself for two
-purposes:
-
-=over 4
-
-=item - Run the startup FIPS self-test known answer tests (KATS).
-
-This is normally done once, at installation time, but may also be set up to
-run each time the module is used.
-
-=item - Verify the module's checksum.
-
-This is done each time the module is used.
-
-=back
-
-This file is generated by the L<openssl-fipsinstall(1)> program, and
-used internally by the FIPS module during its initialization.
-
-The following options are supported. They should all appear in a section
-whose name is identified by the B<fips> option in the B<providers>
-section, as described in L<config(5)/Provider Configuration Module>.
-
-=over 4
-
-=item B<activate>
-
-If present, the module is activated. The value assigned to this name is not
-significant.
-
-=item B<conditional-errors>
-
-The FIPS module normally enters an internal error mode if any self test fails.
-Once this error mode is active, no services or cryptographic algorithms are
-accessible from this point on.
-Continuous tests are a subset of the self tests (e.g., a key pair test during key
-generation, or the CRNG output test).
-Setting this value to C<0> allows the error mode to not be triggered if any
-continuous test fails. The default value of C<1> will trigger the error mode.
-Regardless of the value, the operation (e.g., key generation) that called the
-continuous test will return an error code if its continuous test fails. The
-operation may then be retried if the error mode has not been triggered.
-
-=item B<module-mac>
-
-The calculated MAC of the FIPS provider file.
-
-=item B<install-version>
-
-A version number for the fips install process. Should be 1.
-
-=item B<install-status>
-
-This field is deprecated and is no longer used.
-
-=item B<install-mac>
-
-This field is deprecated and is no longer used.
-
-=back
-
-=head2 FIPS indicator options
-
-The following FIPS configuration options indicate if run-time checks related to
-enforcement of FIPS security parameters such as minimum security strength of
-keys and approved curve names are used.
-A value of '1' will perform the checks, otherwise if the value is '0' the checks
-are not performed and FIPS compliance must be done by procedures documented in
-the relevant Security Policy.
-
-See L<openssl-fipsinstall(1)/OPTIONS> for further information related to these
-options.
-
-=over 4
-
-=item B<security-checks>
-
-See L<openssl-fipsinstall(1)/OPTIONS> B<-no_security_checks>
-
-=item B<tls1-prf-ems-check>
-
-See L<openssl-fipsinstall(1)/OPTIONS> B<-ems_check>
-
-=item B<no-short-mac>
-
-See L<openssl-fipsinstall(1)/OPTIONS> B<-no_short_mac>
-
-=item B<drbg-no-trunc-md>
-
-See L<openssl-fipsinstall(1)/OPTIONS> B<-no_drbg_truncated_digests>
-
-=item B<signature-digest-check>
-
-See L<openssl-fipsinstall(1)/OPTIONS> B<-signature_digest_check>
-
-=item B<hkdf-digest-check>
-
-This option is deprecated.
-
-=item B<tls13-kdf-digest-check>
-
-See L<openssl-fipsinstall(1)/OPTIONS> B<-tls13_kdf_digest_check>
-
-=item B<tls1-prf-digest-check>
-
-See L<openssl-fipsinstall(1)/OPTIONS> B<-tls1_prf_digest_check>
-
-=item B<sshkdf-digest-check>
-
-See L<openssl-fipsinstall(1)/OPTIONS> B<-sshkdf_digest_check>
-
-=item B<sskdf-digest-check>
-
-This option is deprecated.
-
-=item B<x963kdf-digest-check>
-
-See L<openssl-fipsinstall(1)/OPTIONS> B<-x963kdf_digest_check>
-
-=item B<dsa-sign-disabled>
-
-See L<openssl-fipsinstall(1)/OPTIONS> B<-dsa_sign_disabled>
-
-=item B<tdes-encrypt-disabled>
-
-See L<openssl-fipsinstall(1)/OPTIONS> B<-tdes_encrypt_disabled>
-
-=item B<rsa-pkcs15-pad-disabled>
-
-See L<openssl-fipsinstall(1)/OPTIONS> B<-rsa_pkcs15_pad_disabled>
-
-=item B<rsa-pss-saltlen-check>
-
-See L<openssl-fipsinstall(1)/OPTIONS> B<-rsa_pss_saltlen_check>
-
-=item B<rsa-sign-x931-pad-disabled>
-
-See L<openssl-fipsinstall(1)/OPTIONS> B<-rsa_sign_x931_disabled>
-
-=item B<hkdf-key-check>
-
-See L<openssl-fipsinstall(1)/OPTIONS> B<-hkdf_key_check>
-
-=item B<kbkdf-key-check>
-
-See L<openssl-fipsinstall(1)/OPTIONS> B<-kbkdf_key_check>
-
-=item B<tls13-kdf-key-check>
-
-See L<openssl-fipsinstall(1)/OPTIONS> B<-tls13_kdf_key_check>
-
-=item B<tls1-prf-key-check>
-
-See L<openssl-fipsinstall(1)/OPTIONS> B<-tls1_prf_key_check>
-
-=item B<sshkdf-key-check>
-
-See L<openssl-fipsinstall(1)/OPTIONS> B<-sshkdf_key_check>
-
-=item B<sskdf-key-check>
-
-See L<openssl-fipsinstall(1)/OPTIONS> B<-sskdf_key_check>
-
-=item B<x963kdf-key-check>
-
-See L<openssl-fipsinstall(1)/OPTIONS> B<-x963kdf_key_check>
-
-=item B<x942kdf-key-check>
-
-See L<openssl-fipsinstall(1)/OPTIONS> B<-x942kdf_key_check>
-
-=item B<pbkdf2-lower-bound-check>
-
-See L<openssl-fipsinstall(1)/OPTIONS> B<-no_pbkdf2_lower_bound_check>
-
-=item B<ecdh-cofactor-check>
-
-See L<openssl-fipsinstall(1)/OPTIONS> B<-ecdh_cofactor_check>
-
-=item B<hmac-key-check>
-
-See L<openssl-fipsinstall(1)/OPTIONS> B<-hmac_key_check>
-
-=item B<kmac-key-check>
-
-See L<openssl-fipsinstall(1)/OPTIONS> B<-kmac_key_check>
-
-=back
-
-For example:
-
- [fips_sect]
- activate = 1
- install-version = 1
- conditional-errors = 1
- security-checks = 1
- module-mac = 41:D0:FA:C2:5D:41:75:CD:7D:C3:90:55:6F:A4:DC
- install-mac = FE:10:13:5A:D3:B4:C7:82:1B:1E:17:4C:AC:84:0C
- install-status = INSTALL_SELF_TEST_KATS_RUN
-
-=head1 NOTES
-
-When using the FIPS provider, it is recommended that the
-B<config_diagnostics> option is enabled to prevent accidental use of
-non-FIPS validated algorithms via broken or mistaken configuration.
-See L<config(5)>.
-
-=head1 SEE ALSO
-
-L<config(5)>
-L<openssl-fipsinstall(1)>
-
-=head1 HISTORY
-
-This functionality was added in OpenSSL 3.0.
+This command is disabled in Red Hat Enterprise Linux. The FIPS provider is
+automatically loaded when the system is booted in FIPS mode, or when the
+environment variable B<OPENSSL_FORCE_FIPS_MODE> is set. See the documentation
+for more information.
 
 =head1 COPYRIGHT
 
diff --git a/doc/man7/OSSL_PROVIDER-FIPS.pod b/doc/man7/OSSL_PROVIDER-FIPS.pod
index d14005a89a..c3797f5682 100644
--- a/doc/man7/OSSL_PROVIDER-FIPS.pod
+++ b/doc/man7/OSSL_PROVIDER-FIPS.pod
@@ -574,7 +574,6 @@ process.
 
 =head1 SEE ALSO
 
-L<openssl-fipsinstall(1)>,
 L<fips_config(5)>,
 L<OSSL_SELF_TEST_set_callback(3)>,
 L<OSSL_SELF_TEST_new(3)>,
diff --git a/test/recipes/00-prep_fipsmodule_cnf.t b/test/recipes/00-prep_fipsmodule_cnf.t
old mode 100644
new mode 100755
index 4e3a6d85e8..48869b2568
--- a/test/recipes/00-prep_fipsmodule_cnf.t
+++ b/test/recipes/00-prep_fipsmodule_cnf.t
@@ -29,8 +29,10 @@ my $fipsmoduleconf = bldtop_file('test', 'fipsmodule.cnf');
 
 plan tests => 1;
 
+ok(1 == 1);
+
 # Create the $fipsmoduleconf file
-ok(run(app(['openssl', 'fipsinstall', '-pedantic',
-            '-module', $fipsmodule, '-provider_name', 'fips',
-            '-section_name', 'fips_sect', '-out', $fipsmoduleconf])),
-   "fips install");
+#ok(run(app(['openssl', 'fipsinstall', '-pedantic',
+#            '-module', $fipsmodule, '-provider_name', 'fips',
+#            '-section_name', 'fips_sect', '-out', $fipsmoduleconf])),
+#   "fips install");
diff --git a/test/recipes/01-test_fipsmodule_cnf.t b/test/recipes/01-test_fipsmodule_cnf.t
old mode 100644
new mode 100755
index ce594817d5..4530a46dd0
--- a/test/recipes/01-test_fipsmodule_cnf.t
+++ b/test/recipes/01-test_fipsmodule_cnf.t
@@ -31,7 +31,8 @@ plan tests => 1;
 my $fipsmodule = bldtop_file('providers', platform->dso('fips'));
 my $fipsmoduleconf = bldtop_file('test', 'fipsmodule.cnf');
 
+ok(1 == 1)
 # verify the $fipsconf file
-ok(run(app(['openssl', 'fipsinstall',
-            '-in',  $fipsmoduleconf, '-module', $fipsmodule, '-verify'])),
-   "fipsinstall verify");
+#ok(run(app(['openssl', 'fipsinstall',
+#            '-in',  $fipsmoduleconf, '-module', $fipsmodule, '-verify'])),
+#   "fipsinstall verify");
diff --git a/test/recipes/03-test_fipsinstall.t b/test/recipes/03-test_fipsinstall.t
old mode 100644
new mode 100755
index 3dcbe67c6d..1a5a475d91
--- a/test/recipes/03-test_fipsinstall.t
+++ b/test/recipes/03-test_fipsinstall.t
@@ -22,6 +22,8 @@ use lib srctop_dir('Configurations');
 use lib bldtop_dir('.');
 use platform;
 
+plan skip_all => "Fipsinstall not available in Red Hat FIPS build";
+
 plan skip_all => "Test only supported in a fips build" if disabled("fips");
 
 # Compatible options for pedantic FIPS compliance
-- 
2.51.0

