On an OpenWrt 25.12 firmware build, two packages and one small config file move every program that uses OpenSSL onto wolfCrypt FIPS for full FIPS 140-3 support. Add them to the build, flash the image, and that’s it. No patched OpenSSL, no application changes.
OpenSSL 3 offloads its crypto to plug-in providers. wolfProvider is one of those plug-ins, and it runs every operation in wolfCrypt FIPS.
Add two packages to the build
Add the wolfSSL feed to feeds.conf:
src-link wolfssl /path/to/wolfssl-feed
Pull in its two packages and build them into the image:
./scripts/feeds update wolfssl ./scripts/feeds install libwolfprov libwolfssl-fips # in .config, or select both in make menuconfig CONFIG_PACKAGE_libwolfprov=y CONFIG_PACKAGE_libwolfssl-fips=y
Add one config file
The build copies files/ into the image as-is. Add this file:
# files/etc/ssl/modules.cnf.d/zz-wolfprov-only.cnf [provider_sect] libwolfprov = libwolfprov_sect default = wolfprov_default_off_sect [wolfprov_default_off_sect]
This turns off OpenSSL’s built-in default provider, so wolfProvider is the only one left. Then run make.
Flash it and check
root@OpenWrt:~# openssl list -providers
Providers:
libwolfprov
name: wolfSSL Provider
version: 1.2.2
status: active
That’s it. Every program linked against OpenSSL now runs their crypto in wolfCrypt FIPS.
If you have questions, contact us at facts@wolfssl.com or call +1 425 245 8247.
Download wolfSSL Now