FIPS compliant application based on OpenSSL

Question

Let's say I need to write a simple application for signing/checking some data. The hard part is, that it must be FIPS 140-2 compliant. I was thinking to do it using OpenSSL FIPS Object Module 2.0 but then I noticed the "I.G. 9.10 issue".

However, This document states that "The I.G. 9.5 issue has effectively precluded consideration of new validations for much of 2013, but with the July 25 2013 update of the Implementation Guidance (I.G.) document such validations appear to be feasible again.", so it's still unclear for me, if I can use OpenSSL FIPS Object Module 2.0 (#1747).

The question is: can I built an application based on OpenSSL FIPS Object Module 2.0 (#1747) and get it approved by CMVP? If no, what are possible alternatives to it?

Answer 1

Currently in order to get your OpenSSL module validated you have two options: 1) modify the OpenSSL code (or create some other mechanism/modification) to create a "Default Entry Point" (DEP) which ensures self-tests are run first, before allowing any other data output from any other function call. 2) have your lab submit the test report prior to Dec. 31, 2013 with a request for an exemption from 9.10.