René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Include FIPS Module by Default","articleBody":"### What is the problem this feature will solve?\n\nReduce the amount of time and money required to become FIPS validated/certified.\r\n\n\n### What is the feature you are proposing to solve the problem?\n\nWith the integration of OpenSSL 3.x in the Node.JS core (https://nodejs.org/en/blog/release/v17.0.0), the cryptographic system that powers Node.JS is now certified out of the box for FIPS (https://www.openssl.org/blog/blog/2021/09/07/OpenSSL3.Final/ and https://www.openssl.org/blog/blog/2022/08/24/FIPS-validation-certificate-issued/), which reduces the amount of investment necessary to demon straight that the framework is FIPS.\r\n\r\nI propose that the build process for Node.JS be modified so that it includes the FIPS module by default. As it is now, when the module is included in the build, the end user is still responsible for enabling FIPS mode by using the `crypto.setFips` object.\r\nThis allows for devs to not have to use FIPS mode if they don't want to and if they do want to, it will save them tremendous investment and months of validation/certification testing their code every release they make.\r\n\r\nI have personally heard some quotes of north of $100,000 per certification when building from source.\r\nThis would reduce that number dramatically. I have heard some orgs offering to do the paperwork for solutions that have been pre-certified for $10k or less.\r\nThis represents 90% cost savings to devs/orgs (not including the time and build infra costs needed to build from source) that are able to take advantage of the build that comes with the module built in.\n\n### What alternatives have you considered?\n\nDoing it the hard way, building from source :-(","author":{"url":"https://github.com/elliot-huffman","@type":"Person","name":"elliot-huffman"},"datePublished":"2023-03-14T00:39:18Z","url":"https://github.com/nodejs/node/issues/47076"}