How is the library validated?
The FIPS validation applies to a subset of the code, known as the cryptographic module. All of this code lives in the fips/ subdirectory. The OpenSSL tarball includes SHA-1 HMAC fingerprints of all the validated code. The build process checks the digests while building the libcrypto.a library. Therefore, once the build completes, the library necessarily contains the code compiled from the source used for the original validation. When the library has been built, a SHA-1 HMAC fingerprint for the library is generated and is installed along with the library itself. This enables applications, in turn, to validate the FIPS validation of the library.
