Index: modules/ssl/ssl_private.h
===================================================================
--- modules/ssl/ssl_private.h	(revision 719758)
+++ modules/ssl/ssl_private.h	(working copy)
@@ -440,6 +440,9 @@
     BOOL             cipher_server_pref;
     modssl_ctx_t    *server;
     modssl_ctx_t    *proxy;
+#ifdef HAVE_FIPS
+    BOOL             fips;
+#endif
     ssl_log_level_e  ssl_log_level;
 };
 
@@ -521,6 +524,8 @@
 const char *ssl_cmd_SSLOCSPDefaultResponder(cmd_parms *cmd, void *dcfg, const char *arg);
 const char *ssl_cmd_SSLOCSPEnable(cmd_parms *cmd, void *dcfg, int flag);
 
+const char *ssl_cmd_SSLFIPS(cmd_parms *cmd, void *dcfg, int flag);
+
 /**  module initialization  */
 int          ssl_init_Module(apr_pool_t *, apr_pool_t *, apr_pool_t *, server_rec *);
 void         ssl_init_Engine(server_rec *, apr_pool_t *);
Index: modules/ssl/ssl_engine_init.c
===================================================================
--- modules/ssl/ssl_engine_init.c	(revision 719758)
+++ modules/ssl/ssl_engine_init.c	(working copy)
@@ -79,12 +79,25 @@
 {
     SSLModConfigRec *mc = myModConfig(s);
 
+#ifdef HAVE_FIPS
+
+    if (FIPS_mode() && bits < 1024) {
+        mc->pTmpKeys[idx] = NULL;
+        ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
+                     "Init: Skipping generating temporary "
+                     "%d bit RSA private key in FIPS mode", bits);
+        return OK;
+    }
+
+#endif
+
     if (!(mc->pTmpKeys[idx] =
           RSA_generate_key(bits, RSA_F4, NULL, NULL)))
     {
         ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
                      "Init: Failed to generate temporary "
                      "%d bit RSA private key", bits);
+        ssl_log_ssl_error(APLOG_MARK, APLOG_ERR, s);
         return !OK;
     }
 
@@ -96,6 +109,18 @@
 {
     SSLModConfigRec *mc = myModConfig(s);
 
+#ifdef HAVE_FIPS
+
+    if (FIPS_mode() && bits < 1024) {
+        mc->pTmpKeys[idx] = NULL;
+        ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
+                     "Init: Skipping generating temporary "
+                     "%d bit DH parameters in FIPS mode", bits);
+        return OK;
+    }
+
+#endif
+
     if (!(mc->pTmpKeys[idx] =
           ssl_dh_GetTmpParam(bits)))
     {
@@ -231,6 +256,21 @@
      */
     ssl_rand_seed(base_server, ptemp, SSL_RSCTX_STARTUP, "Init: ");
 
+#ifdef HAVE_FIPS
+    if(sc->fips && !FIPS_mode()) {
+        if(FIPS_mode_set(1)) {
+		ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, s,
+			     "FIPS mode enabled");
+        }
+        else {
+            ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, "FIPS mode failed");
+            ssl_log_ssl_error(APLOG_MARK, APLOG_EMERG, s);
+            ssl_die();
+	    }
+	}
+#endif
+
+
     /*
      * read server private keys/public certs into memory.
      * decrypting any encrypted keys via configured SSLPassPhraseDialogs
Index: modules/ssl/ssl_engine_config.c
===================================================================
--- modules/ssl/ssl_engine_config.c	(revision 719758)
+++ modules/ssl/ssl_engine_config.c	(working copy)
@@ -262,6 +262,9 @@
 
     cfgMerge(mc, NULL);
     cfgMerge(enabled, SSL_ENABLED_UNSET);
+#ifdef HAVE_FIPS
+    cfgMergeBool(fips);
+#endif
     cfgMergeBool(proxy_enabled);
     cfgMergeInt(session_cache_timeout);
     cfgMergeBool(cipher_server_pref);
@@ -569,7 +572,18 @@
 
     return "Argument must be On, Off, or Optional";
 }
+#ifdef HAVE_FIPS
 
+const char *ssl_cmd_SSLFIPS(cmd_parms *cmd, void *dcfg, int flag)
+{
+    SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
+
+    sc->fips = flag ? TRUE : FALSE;
+
+    return NULL;
+}
+#endif
+
 const char *ssl_cmd_SSLCipherSuite(cmd_parms *cmd,
                                    void *dcfg,
                                    const char *arg)
Index: modules/ssl/mod_ssl.c
===================================================================
--- modules/ssl/mod_ssl.c	(revision 719758)
+++ modules/ssl/mod_ssl.c	(working copy)
@@ -77,6 +77,11 @@
     SSL_CMD_SRV(Engine, TAKE1,
                 "SSL switch for the protocol engine "
                 "(`on', `off')")
+#ifdef HAVE_FIPS
+    SSL_CMD_SRV(FIPS, FLAG,
+                "Enable FIPS-140 mode "
+                "(`on', `off')")
+#endif
     SSL_CMD_ALL(CipherSuite, TAKE1,
                 "Colon-delimited list of permitted SSL Ciphers "
                 "(`XXX:...:XXX' - see manual)")
Index: modules/ssl/ssl_toolkit_compat.h
===================================================================
--- modules/ssl/ssl_toolkit_compat.h	(revision 719758)
+++ modules/ssl/ssl_toolkit_compat.h	(working copy)
@@ -111,6 +111,10 @@
 # define MODSSL_D2I_X509_CONST
 #endif
 
+#if (OPENSSL_VERSION_NUMBER >= 0x009080a0) && defined(OPENSSL_FIPS)
+#define HAVE_FIPS
+#endif
+
 #if (OPENSSL_VERSION_NUMBER >= 0x00909000)
 # define MODSSL_SSL_METHOD_CONST const
 #else
