diff --git a/src/crypto/crypto.c b/src/crypto/crypto.c
index 2e53e74bb..ead054370 100644
--- a/src/crypto/crypto.c
+++ b/src/crypto/crypto.c
@@ -17,8 +17,8 @@
 #include <assert.h>
 #include <stdio.h>
 
-#include "fipsmodule/rand/internal.h"
 #include "bcm_support.h"
+#include "fipsmodule/rand/internal.h"
 #include "internal.h"
 
 
@@ -132,14 +132,6 @@ int CRYPTO_is_confidential_build(void) {
 #endif
 }
 
-int CRYPTO_has_asm(void) {
-#if defined(OPENSSL_NO_ASM)
-  return 0;
-#else
-  return 1;
-#endif
-}
-
 void CRYPTO_pre_sandbox_init(void) {
   // Read from /proc/cpuinfo if needed.
   OPENSSL_init_cpuid();
diff --git a/src/crypto/fipsmodule/self_check/fips.c.inc b/src/crypto/fipsmodule/self_check/fips.c.inc
index ca6fb3ac3..920a6cb08 100644
--- a/src/crypto/fipsmodule/self_check/fips.c.inc
+++ b/src/crypto/fipsmodule/self_check/fips.c.inc
@@ -30,6 +30,14 @@ int FIPS_mode_set(int on) { return on == FIPS_mode(); }
 
 const char *FIPS_module_name(void) { return "BoringCrypto"; }
 
+int CRYPTO_has_asm(void) {
+#if defined(OPENSSL_NO_ASM)
+  return 0;
+#else
+  return 1;
+#endif
+}
+
 uint32_t FIPS_version(void) {
   return 0;
 }
diff --git a/src/include/openssl/crypto.h b/src/include/openssl/crypto.h
index 384b94c4d..64bc0e758 100644
--- a/src/include/openssl/crypto.h
+++ b/src/include/openssl/crypto.h
@@ -181,7 +181,7 @@ OPENSSL_EXPORT int FIPS_mode_set(int on);
 OPENSSL_EXPORT const char *FIPS_module_name(void);
 
 // FIPS_module_hash returns the 32-byte hash of the FIPS module.
-OPENSSL_EXPORT const uint8_t* FIPS_module_hash(void);
+OPENSSL_EXPORT const uint8_t *FIPS_module_hash(void);
 
 // FIPS_version returns the version of the FIPS module, or zero if the build
 // isn't exactly at a verified version. The version, expressed in base 10, will
diff --git a/src/util/fipstools/acvp/modulewrapper/main.cc b/src/util/fipstools/acvp/modulewrapper/main.cc
index 546091f31..0997055f5 100644
--- a/src/util/fipstools/acvp/modulewrapper/main.cc
+++ b/src/util/fipstools/acvp/modulewrapper/main.cc
@@ -12,10 +12,11 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
 
+#include <inttypes.h>
 #include <stdio.h>
-#include <string>
 #include <string.h>
 #include <unistd.h>
+#include <string>
 
 #include <openssl/crypto.h>
 #include <openssl/span.h>
@@ -41,6 +42,34 @@ int main(int argc, char **argv) {
 #error "FIPS build not supported on this architecture"
 #endif
 
+    if (!FIPS_mode()) {
+      printf("Module not in FIPS mode\n");
+      abort();
+    }
+    printf("Module is in FIPS mode\n");
+
+    const uint32_t module_version = FIPS_version();
+    if (module_version == 0) {
+      printf("No module version set\n");
+      abort();
+    }
+    printf("Module: '%s', version: %" PRIu32 " hash:\n", FIPS_module_name(),
+           module_version);
+
+#if !defined(BORINGSSL_FIPS)
+    // |module_version| will be zero, so the non-FIPS build will never get
+    // this far.
+    printf("Non zero module version in non-FIPS build - should not happen!\n");
+    abort();
+#elif defined(OPENSSL_ASAN)
+    printf("(not available when compiled for ASAN)");
+#else
+    const uint8_t *module_hash = FIPS_module_hash();
+    for (size_t i = 0; i < SHA256_DIGEST_LENGTH; i++) {
+      printf("%02x", module_hash[i]);
+    }
+    printf("\n");
+#endif
     printf("Hardware acceleration enabled: %s\n",
            CRYPTO_has_asm() ? "yes" : "no");