diff -up openssl-3.0.0/crypto/provider_conf.c.fips-force openssl-3.0.0/crypto/provider_conf.c
--- openssl-3.0.0/crypto/provider_conf.c.fips-force	2021-11-12 14:21:01.878339467 +0100
+++ openssl-3.0.0/crypto/provider_conf.c	2021-11-12 16:13:19.301542866 +0100
@@ -136,13 +136,73 @@ static int prov_already_activated(const
     return 0;
 }
 
+static int provider_conf_activate(OSSL_LIB_CTX *libctx, PROVIDER_CONF_GLOBAL *pcgbl,
+                                  const char *name, const char *value, const char *path,
+                                  int soft, const CONF *cnf)
+{
+    int ok = 0;
+    OSSL_PROVIDER *prov = NULL, *actual = NULL;
+
+    if (!CRYPTO_THREAD_write_lock(pcgbl->lock)) {
+        ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
+        return 0;
+    }
+    if (!prov_already_activated(name, pcgbl->activated_providers)) {
+        /*
+        * There is an attempt to activate a provider, so we should disable
+        * loading of fallbacks. Otherwise a misconfiguration could mean the
+        * intended provider does not get loaded. Subsequent fetches could
+        * then fallback to the default provider - which may be the wrong
+        * thing.
+        */
+        if (!ossl_provider_disable_fallback_loading(libctx)) {
+            CRYPTO_THREAD_unlock(pcgbl->lock);
+            ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
+            return 0;
+        }
+        prov = ossl_provider_find(libctx, name, 1);
+        if (prov == NULL)
+            prov = ossl_provider_new(libctx, name, NULL, 1);
+        if (prov == NULL) {
+            CRYPTO_THREAD_unlock(pcgbl->lock);
+            if (soft)
+                ERR_clear_error();
+            return 0;
+        }
+
+        if (path != NULL)
+            ossl_provider_set_module_path(prov, path);
+
+        ok = cnf ? provider_conf_params(prov, NULL, NULL, value, cnf) : 1;
+
+        if (ok) {
+            if (!ossl_provider_activate(prov, 1, 0)) {
+                ok = 0;
+            } else if (!ossl_provider_add_to_store(prov, &actual, 0)) {
+                ossl_provider_deactivate(prov);
+                ok = 0;
+            } else {
+                if (pcgbl->activated_providers == NULL)
+                    pcgbl->activated_providers = sk_OSSL_PROVIDER_new_null();
+                sk_OSSL_PROVIDER_push(pcgbl->activated_providers, actual);
+                ok = 1;
+            }
+        }
+        if (!ok)
+            ossl_provider_free(prov);
+    }
+    CRYPTO_THREAD_unlock(pcgbl->lock);
+    return ok;
+}
+
+
+
 static int provider_conf_load(OSSL_LIB_CTX *libctx, const char *name,
                               const char *value, const CONF *cnf)
 {
     int i;
     STACK_OF(CONF_VALUE) *ecmds;
     int soft = 0;
-    OSSL_PROVIDER *prov = NULL, *actual = NULL;
     const char *path = NULL;
     long activate = 0;
     int ok = 0;
@@ -185,55 +245,7 @@ static int provider_conf_load(OSSL_LIB_C
     }
 
     if (activate) {
-        if (!CRYPTO_THREAD_write_lock(pcgbl->lock)) {
-            ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
-            return 0;
-        }
-        if (!prov_already_activated(name, pcgbl->activated_providers)) {
-            /*
-            * There is an attempt to activate a provider, so we should disable
-            * loading of fallbacks. Otherwise a misconfiguration could mean the
-            * intended provider does not get loaded. Subsequent fetches could
-            * then fallback to the default provider - which may be the wrong
-            * thing.
-            */
-            if (!ossl_provider_disable_fallback_loading(libctx)) {
-                CRYPTO_THREAD_unlock(pcgbl->lock);
-                ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
-                return 0;
-            }
-            prov = ossl_provider_find(libctx, name, 1);
-            if (prov == NULL)
-                prov = ossl_provider_new(libctx, name, NULL, 1);
-            if (prov == NULL) {
-                CRYPTO_THREAD_unlock(pcgbl->lock);
-                if (soft)
-                    ERR_clear_error();
-                return 0;
-            }
-
-            if (path != NULL)
-                ossl_provider_set_module_path(prov, path);
-
-            ok = provider_conf_params(prov, NULL, NULL, value, cnf);
-
-            if (ok) {
-                if (!ossl_provider_activate(prov, 1, 0)) {
-                    ok = 0;
-                } else if (!ossl_provider_add_to_store(prov, &actual, 0)) {
-                    ossl_provider_deactivate(prov);
-                    ok = 0;
-                } else {
-                    if (pcgbl->activated_providers == NULL)
-                        pcgbl->activated_providers = sk_OSSL_PROVIDER_new_null();
-                    sk_OSSL_PROVIDER_push(pcgbl->activated_providers, actual);
-                    ok = 1;
-                }
-            }
-            if (!ok)
-                ossl_provider_free(prov);
-        }
-        CRYPTO_THREAD_unlock(pcgbl->lock);
+        ok = provider_conf_activate(libctx, pcgbl, name, value, path, soft, cnf);
     } else {
         OSSL_PROVIDER_INFO entry;
 
@@ -294,6 +306,19 @@ static int provider_conf_init(CONF_IMODU
             return 0;
     }
 
+    if (ossl_get_kernel_fips_flag() != 0) { /* XXX from provider_conf_load */
+        OSSL_LIB_CTX *libctx = NCONF_get0_libctx((CONF *)cnf);
+        PROVIDER_CONF_GLOBAL *pcgbl
+            = ossl_lib_ctx_get_data(libctx, OSSL_LIB_CTX_PROVIDER_CONF_INDEX,
+                                    &provider_conf_ossl_ctx_method);
+        if (provider_conf_activate(libctx, pcgbl, "fips", NULL, NULL, 0, NULL) != 1)
+            return 0;
+        if (provider_conf_activate(libctx, pcgbl, "base", NULL, NULL, 0, NULL) != 1)
+            return 0;
+        if (EVP_default_properties_enable_fips(libctx, 1) != 1)
+            return 0;
+    }
+
     return 1;
 }