Both reg-tests fail when run against an SSL library running in FIPS
mode (e.g. AWS-LC-FIPS), for two distinct reasons:
- tls12_ssl_crt-list_filters.vtc configures the "kRSA" (non-ECDHE)
TLSv1.2 cipher suite, which is rejected at config-parse time by
HAProxy's own FIPS compliance checks (src/fips.c).
- ssl_generate_certificate.vtc's P-384 check observes the default
curve/group (e.g. P-256) instead of the configured secp384r1: the
"ecdhe" bind keyword does not appear to restrict the negotiated
curve/group in this mode, reproduced independently of the TLS
version forced by the client.
Skip both using the newly introduced fips_mode() config condition
predicate rather than disabling them outright, so they keep running
everywhere else.