OpenSSL error when trying to enable FIPS

[devalexqt]

Version

v20.0.0-pre

Platform

Linux server 5.15.0-67-generic #74-Ubuntu SMP Wed Feb 22 14:14:39 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

Subsystem

No response

What steps will reproduce the bug?

Follow the instruction https://github.com/nodejs/node/blob/main/BUILDING.md#building-nodejs-with-fips-compliant-openssl to build node with quic support, but then I finnaly compile and test node: ./node --enable-fips -p 'crypto.getFips(), I got error:

./node: OpenSSL error when trying to enable FIPS:
40EC6CFCCA7F0000:error:1C8000D5:Provider routines:SELF_TEST_post:missing config data:providers/fips/self_test.c:290:

How often does it reproduce? Is there a required condition?

100%

What is the expected behavior? Why is that the expected behavior?

./node --enable-fips -p 'crypto.getFips() must return 1 as indicated in docs: https://github.com/nodejs/node/blob/main/BUILDING.md#building-nodejs-with-fips-compliant-openssl

What do you see instead?

./node --enable-fips -p 'crypto.getFips()'

./node: OpenSSL error when trying to enable FIPS:
40EC6CFCCA7F0000:error:1C8000D5:Provider routines:SELF_TEST_post:missing config data:providers/fips/self_test.c:290:

Additional information

ldd ./node

        linux-vdso.so.1 (0x00007fff51b62000)
        libcrypto.so.81.3 => /path/to/install/dir/lib64/libcrypto.so.81.3 (0x00007fc4fa580000)
        libssl.so.81.3 => /path/to/install/dir/lib64/libssl.so.81.3 (0x00007fc4fa4ce000)
        libstdc++.so.6 => /lib/x86_64-linux-gnu/libstdc++.so.6 (0x00007fc4fa2a4000)
        libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007fc4fa1bd000)
        libgcc_s.so.1 => /lib/x86_64-linux-gnu/libgcc_s.so.1 (0x00007fc4fa19d000)
        libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fc4f9f75000)
        /lib64/ld-linux-x86-64.so.2 (0x00007fc4ff6c0000)

./node -p process.versions.openssl

3.0.8+quic

./node -p 'process.config.variables.openssl_is_fips'

true

[bnoordhuis]

I've converted this to a discussion because the error message already hints at what's going on, and that isn't a node bug.

[devalexqt]

So, how to compile node with Quic?

[bnoordhuis]

You fix your openssl build. That error message means your copy of openssl is misconfigured.

[devalexqt]

But I follow the instructions in docs.

[devalexqt]

Still no answer how to do it.

[andrefsilveira1]

I'm too late, but I'll share what solved the problem for me. I faced this issue few days ago and fixed it by updating my openssl.cnf file to include the openssl and node init section.

openssl_conf = openssl_init

nodejs_conf = nodejs_init

.include path/to/your/fipsmodule.cnf

[openssl_init]
providers = provider_sect
alg_section = algorithm_sect

[nodejs_init]
providers = provider_sect
alg_section = algorithm_sect

[provider_sect]
default = default_sect
fips = fips_sect

[default_sect]
activate = 1

[algorithm_sect]
default_properties = fips=yes"

It seems that node was not using the correct openssl path. Updating the openssl.cnf file, node will use the installed openssl instead bundled ssl. I don't know if this will work for you, but might help someone else.