Does anyone knows why in some OpenSSH patches for FIPS we have something like: SSLeay_add_all_algorithms(); if (FIPS_mode() && !FIPSCHECK_verify(NULL, NULL)) { fprintf(stderr, "FIPS integrity verification test failed.\n"); exit(3); } This block of code is always in main() soon after starting service/client. Why are they checking FIPS_mode() if the FIPS_mode_set() wasn't even called before that ? The SSLeay_add_all_algorithms() is supposed call FIPS_mode_set() ? Another question I have is why are they using FIPSCHECK_verify() from libfipscheck if the FIPS_mode_set() already check the incore fingerprint when called. Is this another requirement from FIPS 140-2 ? Great thanks ! -- "Forgive, O Lord, my little jokes on Thee, and I'll forgive Thy great big joke on me." http://pyevolve.sourceforge.net/wordpress/