Detailed information on the NIST Cryptographic Module Validation Program (CMVP) is available at the following website: http://csrc.nist.gov/groups/STM/cmvp/index.html. Review system documentation to determine whether cryptography for classified or sensitive information is required by the information owner. If the system documentation does not specify the type of information hosted on MySQL: classified, sensitive, and/or unclassified, this is a finding. If classified or sensitive information does not exist within MySQL Server, this is not a finding. Verify that the operating system provides the OpenSSL FIPS Object Module, and is configured to require the use of OpenSSL of FIPS compliant algorithms, available at MySQL runtime. If the Security Setting for FIPS mode option is "Disabled" on the server's OS, this is a finding. If cryptography is being used by MySQL, verify that the cryptography is NIST FIPS certified by running the following SQL query: Determine if MySQL is running in FIPS mode. select @@ssl_fips_mode; If ssl_fips_mode is not "ON" or "STRICT", this is a finding. View the versions of TLS, then review the cipher suites in use for the versions returned by statement: SELECT VARIABLE_NAME, VARIABLE_VALUE FROM performance_schema.global_variables WHERE VARIABLE_NAME = 'tls_version'; If the results include less than version TLS 1.2, for example TLS 1.0 or 1.1, this is a finding. If the results include TLS 1.2 view the supported ciphers on the MySQL Server, run select * from performance_schema.global_status where variable_name= 'Ssl_cipher_list'; If the results include TLS 1.3 view the supported ciphers on the MySQL Server, run SELECT VARIABLE_NAME, VARIABLE_VALUE FROM performance_schema.global_variables WHERE VARIABLE_NAME = 'tls_ciphersuites'; If any results list show an uncertified NIST FIPS 140-2 algorithm type, this is a finding. Check MySQL certificate PEM file(s) for compliance with DoD requirements by running this command: openssl x509 -in server-cert.pem -text -noout If any PEM file is not in compliance, this is a finding.