Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I compiled and installed strongswan ipsec vpn successfully, as demonstrated by the fact that the service starts successfully:

as3:~# ipsec restart
Stopping strongSwan IPsec...
Starting strongSwan 5.0.4 IPsec [starter]...

When I run command ipsec pki --gen --outform pem > caKey.pem I see the error:

as3:~# ipsec pki --gen --outform pem > caKey.pem
openssl FIPS mode(0) unavailable

What does "openssl FIPS mode(0) unavailable" mean? How to fix it?

share|improve this question

This message is logged in strongSwan 5.0.4 if OpenSSL is not compiled with FIPS mode enabled, that is if OPENSSL_FIPS is not defined in openssl/opensslconf.h.

In future releases it will only be logged if the user actually wants to use OpenSSL in FIPS mode, either by setting

    where MODE is either 0 (disabled, default), 1 (enabled), or 2 (Suite B enabled)

during ./configure or by setting

    same values as above, the default is also 0.

in strongswan.conf to a value != 0.

Therefore, if you dont't want to use OpenSSL in FIPS mode, as is indicated by the (0) in the log message you posted, you can safely ignore this message.

share|improve this answer

It seems you missed openssl fips mode plugin when you compiled strongswan.


Set OpenSSL FIPS mode: disabled (0), enabled (1), Suite B enabled (2). Defaults to the value configured with the --with-fips-mode option

You can re-compile strongswan, or make change to openssl config:

# Default section
XXXX_conf = XXXX_options
[ XXXX_options ]
alg_section = algs
[ algs ]
fips_mode = yes
share|improve this answer
hi,mr gnouc:i re-compiled strongswan with "--with-fips-mode" parameter but useless,when i run "ipsec pki --gen --outform pem > caKey.pem",i still met the error-"openssl FIPS mode(0) unavailable". – fisherman May 16 '13 at 8:27
What is your ssl config? Please post here? – cuonglm May 16 '13 at 8:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.