Rust FIPS 140-3 Implementation with CryptoComply Core 

Prerequisites

Before proceeding, make sure you have:

• Rust toolchain installed via rustup
• CryptoComply Core binaries from the SafeLogic Customer Portal
• Example Rust application source trees
• Build dependencies including:
• C/C++ compiler toolchain
• pkg-config
• curl
• perl
• git
• wget
• CA certificates
• Docker, optional, for automated build and test workflows

Example source layout:

/app/
├── crate-openssl/
│   ├── Cargo.toml
│   └── src/
│       └── main.rs
└── crate-rustls-openssl/
    ├── Cargo.toml
    └── src/
        └── main.rs
  

For Debian-based systems:

apt-get update
apt-get install -y wget git build-essential ca-certificates curl pkg-config perl

Set Environment Variables

Point Rust, Cargo, openssl-sys, and pkg-config to the CryptoComply OpenSSL installation instead of the system OpenSSL defaults.

export OPENSSL_DIR=/usr/local
export OPENSSL_LIB_DIR=/usr/local/lib
export OPENSSL_INCLUDE_DIR=/usr/local/include
export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig
export OPENSSL_CONF=/usr/local/ssl/openssl.cnf
export OPENSSL_MODULES=/usr/local/lib/ossl-modules
export LD_LIBRARY_PATH=/usr/local/lib
  

These variables ensure that Rust build scripts and runtime linking resolve the CryptoComply-provided OpenSSL headers, libraries, configuration, and provider modules.

Update the Dynamic Linker

Configure the system dynamic linker so the runtime loader can locate the CryptoComply OpenSSL libraries.

export OPENSSL_CONF=/usr/local/ssl/openssl.cnf
echo "/usr/local/lib" > /etc/ld.so.conf.d/openssl.conf
ldconfig
  

Verify the build

Basic checks

nginx -v
nginx -t
  

The automated build flow also includes an enable-fips.sh helper intended to enable FIPS mode before the Rust crate examples are verified.

Build rust-openssl

The first example builds a Rust application using the rust-openssl crate.

cargo build --release --manifest-path /app/crate-openssl/Cargo.toml
  

Verify that the resulting executable links to CryptoComply OpenSSL:

 
ldd /app/crate-openssl/target/release/cc-crate-openssl | grep /usr/local/lib

The expected output should show OpenSSL libraries resolving from /usr/local/lib, for example:

libssl.so.3 => /usr/local/lib/libssl.so.3
libcrypto.so.3 => /usr/local/lib/libcrypto.so.3

Build rustls-openssl

The second example builds a Rust application using the rustls-openssl crate while relying on the same CryptoComply installation.

cargo build --release --manifest-path /app/crate-rustls-openssl/Cargo.toml
  

Verify linkage:

 
ldd /app/crate-rustls-openssl/target/release/cc-rustls-openssl | grep /usr/local/lib

Expected output should again confirm that the executable resolves OpenSSL libraries from /usr/local/lib.