There does not seem to be a way to enable FIPS mode on the application level. Currently we solve this by compiling nginx ourselves after adding FIPS_mode_set(1) after the SSL library initialization code in systems where we require it. It would be nice to have native optional support for this.

For reference, apache's mod_ssl has this support: http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslfips, so a similiar setting would probably be useful for others as well.

I'd also love to see this supported out of the box. I can't imagine it's particularly difficult, but given that I'm not a C guy, I don't dare attempt a PR.

teemu, any chance you can share the patch file you use to achieve fips module support? I'd love to compare notes.