联邦信息处理标准 140-2 (FIPS 140-2) 描述了一项安全标准，美国联邦政府机构可能会要求加密模块遵守该标准，以保护敏感或有价值的信息。为了被认为适合联邦使用，加密模块必须获得 FIPS 140-2 认证。如果一个用于保护敏感数据的系统缺乏适当的 FIPS 140-2 证书，联邦机构将无法购买它。Federal Information Processing Standards 140-2 (FIPS 140-2) describes a security standard that can be required by Federal (US Government) agencies for cryptographic modules used to protect sensitive or valuable information. To be considered acceptable for such Federal use, a cryptographic module must be certified for FIPS 140-2. If a system intended to protect sensitive data lacks the proper FIPS 140-2 certificate, Federal agencies cannot purchase it.

诸如 OpenSSL 之类的产品可以在 FIPS 模式下使用，尽管 OpenSSL 库本身未通过 FIPS 验证。相反，OpenSSL 库是与 OpenSSL FIPS 对象模块一起使用，以使基于 OpenSSL 的应用程序能够在 FIPS 模式下运行。Products such as OpenSSL can be used in FIPS mode, although the OpenSSL library itself is not validated for FIPS. Instead, the OpenSSL library is used with the OpenSSL FIPS Object Module to enable OpenSSL-based applications to operate in FIPS mode.

关于 FIPS 及其在 OpenSSL 中的实现的一般信息，以下参考资料可能会有帮助：For general information about FIPS and its implementation in OpenSSL, these references may be helpful:

为了让 MySQL 支持 FIPS 模式，必须满足以下系统要求：For MySQL to support FIPS mode, these system requirements must be satisfied:

要确定 MySQL 是否在启用了 FIPS 模式的系统上运行，请使用 SQL 语句检查 ssl_fips_mode 服务器系统变量的值，例如 SHOW VARIABLES LIKE '%fips%' 或 SELECT @@ssl_fips_mode。如果该变量的值为 1 (ON) 或 2 (STRICT)，则 FIPS 模式对 OpenSSL 已启用；如果该值为 0 (OFF)，则 FIPS 模式不可用。To determine whether MySQL is running on a system with FIPS mode enabled, check the value of the ssl_fips_mode server system variable using an SQL statement such as SHOW VARIABLES LIKE '%fips%' or SELECT @@ssl_fips_mode. If the value of this variable is 1 (ON) or 2 (STRICT), FIPS mode is enabled for OpenSSL; if it is 0 (OFF), FIPS mode is not available.

服务器端的 FIPS 模式适用于服务器执行的加密操作，包括由 MySQL 复制（包括组复制）和 X 插件执行的操作，这些操作在服务器内部运行。FIPS mode on the server side applies to cryptographic operations performed by the server, including those performed by MySQL Replication (including Group Replication) and X Plugin, which run within the server.

FIPS 模式同样适用于客户端尝试连接服务器的情况。当在客户端或服务器端启用时，它会限制可选择的支持的加密算法。然而，启用 FIPS 模式并不要求必须使用加密连接，也不要求用户凭证必须加密。例如，如果启用 FIPS 模式，则需使用更强的加密算法。特别是，MD5 受到限制，因此尝试使用诸如 RC4-MD5 的加密算法建立加密连接将无法成功。但 FIPS 模式并不阻止建立未加密连接。（要实现这一点，你可以对特定用户账户使用 CREATE USER 或 ALTER USER 的 REQUIRE 子句，或者设置 require_secure_transport 系统变量以影响所有账户。）FIPS mode also applies to attempts by clients to connect to the server. When enabled, on either the client or server side, it restricts which of the supported encryption ciphers can be chosen. However, enabling FIPS mode does not require that an encrypted connection must be used, or that user credentials must be encrypted. For example, if FIPS mode is enabled, stronger cryptographic algorithms are required. In particular, MD5 is restricted, so trying to establish an encrypted connection using an encryption cipher such as RC4-MD5 does not work. But there is nothing about FIPS mode that prevents establishing an unencrypted connection. (To do that, you can use the REQUIRE clause for CREATE USER or ALTER USER for specific user accounts, or set the require_secure_transport system variable to affect all accounts.)

如果需要 FIPS 模式，建议使用包含该模式的操作平台；如果有，您可以（并且应该）使用它。如果您的平台不包含 FIPS，您有两个选项：If FIPS mode is required, it is recommended to use an operating platforms that includes it; if it does, you can (and should) use it. If your platform does not include FIPS, you have two options:

如果需要 FIPS 模式，建议使用包含该模式的操作平台；如果包含，您可以（并且应该）使用它。如果您的平台不包含 FIPS，您有两个选项：If FIPS mode is required, it is recommended to use an operating platform that includes it; if it does, you can (and should) use it. If your platform does not include FIPS, you have two options: