Commit 38242ab403 for openssl.org

commit 38242ab403a292eef6f0f91796526b2183c8bb50
Author: Enji Cooper <yaneurabeya@gmail.com>
Date:   Wed Jul 1 16:38:24 2026 -0700

    fips: make diagnosing `*-mac` issues in openssl.cnf easier

    Prior to this change, if either the config data or checksum data
    for a provider was missing, a single error would have been emitted for
    the two scenarios, resulting in potential confusion around missing
    checksum data from `openssl.cnf`.

    This change splits apart the conditional to help the end-user better
    determine why loading the FIPS provider failed after running the
    self-test check. A new error,
    `PROV_R_FIPS_MODULE_MISSING_CHECKSUM`, is added to capture this
    [new] more fine-grain error state.

    Signed-off-by: Enji Cooper <yaneurabeya@gmail.com>
    Reviewed-by: Paul Dale <paul.dale@oracle.com>
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    Merge-date: Wed Aug 26 09:26:38 2026
    Merged-from: https://github.com/openssl/openssl/pull/31820

diff --git a/crypto/err/openssl.txt b/crypto/err/openssl.txt
index de4b47ebb7..d3bc53f8aa 100644
--- a/crypto/err/openssl.txt
+++ b/crypto/err/openssl.txt
@@ -1056,6 +1056,7 @@ PROV_R_FIPS_MODULE_CONDITIONAL_ERROR:227:fips module conditional error
 PROV_R_FIPS_MODULE_ENTERING_ERROR_STATE:224:fips module entering error state
 PROV_R_FIPS_MODULE_IMPORT_PCT_ERROR:253:fips module import pct error
 PROV_R_FIPS_MODULE_IN_ERROR_STATE:225:fips module in error state
+PROV_R_FIPS_MODULE_MISSING_CHECKSUM:267:fips module missing checksum
 PROV_R_GENERATE_ERROR:191:generate error
 PROV_R_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE:165:\
 	illegal or unsupported padding mode
diff --git a/include/openssl/proverr.h b/include/openssl/proverr.h
index 0db3a82b47..34bd02af9d 100644
--- a/include/openssl/proverr.h
+++ b/include/openssl/proverr.h
@@ -49,6 +49,7 @@
 #define PROV_R_FIPS_MODULE_ENTERING_ERROR_STATE 224
 #define PROV_R_FIPS_MODULE_IMPORT_PCT_ERROR 253
 #define PROV_R_FIPS_MODULE_IN_ERROR_STATE 225
+#define PROV_R_FIPS_MODULE_MISSING_CHECKSUM 267
 #define PROV_R_GENERATE_ERROR 191
 #define PROV_R_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE 165
 #define PROV_R_INDICATOR_INTEGRITY_FAILURE 210
diff --git a/providers/common/provider_err.c b/providers/common/provider_err.c
index 33e7edb454..0566dd1e51 100644
--- a/providers/common/provider_err.c
+++ b/providers/common/provider_err.c
@@ -67,6 +67,8 @@ static const ERR_STRING_DATA PROV_str_reasons[] = {
         "fips module import pct error" },
     { ERR_PACK(ERR_LIB_PROV, 0, PROV_R_FIPS_MODULE_IN_ERROR_STATE),
         "fips module in error state" },
+    { ERR_PACK(ERR_LIB_PROV, 0, PROV_R_FIPS_MODULE_MISSING_CHECKSUM),
+        "fips module missing checksum" },
     { ERR_PACK(ERR_LIB_PROV, 0, PROV_R_GENERATE_ERROR), "generate error" },
     { ERR_PACK(ERR_LIB_PROV, 0, PROV_R_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE),
         "illegal or unsupported padding mode" },
diff --git a/providers/fips/self_test.c b/providers/fips/self_test.c
index 364fd0ef65..391e368626 100644
--- a/providers/fips/self_test.c
+++ b/providers/fips/self_test.c
@@ -325,11 +325,14 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, void *fips_global,
         return 0;
     }

-    if (st == NULL
-        || st->module_checksum_data == NULL) {
+    if (st == NULL) {
         ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_CONFIG_DATA);
         goto end;
     }
+    if (st->module_checksum_data == NULL) {
+        ERR_raise(ERR_LIB_PROV, PROV_R_FIPS_MODULE_MISSING_CHECKSUM);
+        goto end;
+    }

     ev = OSSL_SELF_TEST_new(st->cb, st->cb_arg);
     if (ev == NULL)