OpenSSL error when trying to enable FIPS

[devalexqt]

Version

v20.0.0-pre

Platform

Linux server 5.15.0-67-generic #74-Ubuntu SMP Wed Feb 22 14:14:39 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

Subsystem

No response

What steps will reproduce the bug?

Follow the instruction https://github.com/nodejs/node/blob/main/BUILDING.md#building-nodejs-with-fips-compliant-openssl to build node with quic support, but then I finnaly compile and test node: ./node --enable-fips -p 'crypto.getFips(), I got error:

./node: OpenSSL error when trying to enable FIPS:
40EC6CFCCA7F0000:error:1C8000D5:Provider routines:SELF_TEST_post:missing config data:providers/fips/self_test.c:290:

How often does it reproduce? Is there a required condition?

100%

What is the expected behavior? Why is that the expected behavior?

./node --enable-fips -p 'crypto.getFips() must return 1 as indicated in docs: https://github.com/nodejs/node/blob/main/BUILDING.md#building-nodejs-with-fips-compliant-openssl

What do you see instead?

./node --enable-fips -p 'crypto.getFips()'

./node: OpenSSL error when trying to enable FIPS:
40EC6CFCCA7F0000:error:1C8000D5:Provider routines:SELF_TEST_post:missing config data:providers/fips/self_test.c:290:

Additional information

ldd ./node

        linux-vdso.so.1 (0x00007fff51b62000)
        libcrypto.so.81.3 => /path/to/install/dir/lib64/libcrypto.so.81.3 (0x00007fc4fa580000)
        libssl.so.81.3 => /path/to/install/dir/lib64/libssl.so.81.3 (0x00007fc4fa4ce000)
        libstdc++.so.6 => /lib/x86_64-linux-gnu/libstdc++.so.6 (0x00007fc4fa2a4000)
        libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007fc4fa1bd000)
        libgcc_s.so.1 => /lib/x86_64-linux-gnu/libgcc_s.so.1 (0x00007fc4fa19d000)
        libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fc4f9f75000)
        /lib64/ld-linux-x86-64.so.2 (0x00007fc4ff6c0000)

./node -p process.versions.openssl

3.0.8+quic

./node -p 'process.config.variables.openssl_is_fips'

true

[bnoordhuis]

I've converted this to a discussion because the error message already hints at what's going on, and that isn't a node bug.

[devalexqt]

So, how to compile node with Quic?

[bnoordhuis]

You fix your openssl build. That error message means your copy of openssl is misconfigured.

[devalexqt]

But I follow the instructions in docs.

[devalexqt]

Still no answer how to do it.

[andrefsilveira1]

I'm too late, but I'll share what solved the problem for me. I faced this issue few days ago and fixed it by updating my openssl.cnf file to include the openssl and node init section.

openssl_conf = openssl_init

nodejs_conf = nodejs_init

.include path/to/your/fipsmodule.cnf

[openssl_init]
providers = provider_sect
alg_section = algorithm_sect

[nodejs_init]
providers = provider_sect
alg_section = algorithm_sect

[provider_sect]
default = default_sect
fips = fips_sect

[default_sect]
activate = 1

[algorithm_sect]
default_properties = fips=yes"

It seems that node was not using the correct openssl path. Updating the openssl.cnf file, node will use the installed openssl instead bundled ssl. I don't know if this will work for you, but might help someone else.

[sunnypatell]

Your issue appears to be related to OpenSSL’s FIPS module configuration, not Node.js itself. The error:

OpenSSL error when trying to enable FIPS:
40EC6CFCCA7F0000:error:1C8000D5:Provider routines:SELF_TEST_post:missing config data:providers/fips/self_test.c:290:

suggests that **the OpenSSL FIPS provider is not properly configured or missing essential configuration settings**.

### Steps to Fix:
1. **Ensure OpenSSL is compiled with FIPS support**  
   Run:
   ```sh
   openssl list -providers

If fips is missing, your OpenSSL build does not support FIPS.

2. Check OpenSSL Version Compatibility
   Node.js v20 uses OpenSSL 3.x, and FIPS support requires OpenSSL 3.0+. Confirm with:

   openssl version -a

   Ensure you see FIPS=yes.

3. Update openssl.cnf with FIPS Config
   Modify your OpenSSL configuration file (openssl.cnf) to explicitly include FIPS mode:

   openssl_conf = openssl_init
   
   nodejs_conf = nodejs_init
   
   .include path/to/your/fipsmodule.cnf
   
   [openssl_init]
   providers = provider_sect
   alg_section = algorithm_sect
   
   [nodejs_init]
   providers = provider_sect
   alg_section = algorithm_sect
   
   [provider_sect]
   default = default_sect
   fips = fips_sect
   
   [default_sect]
   activate = 1
   
   [algorithm_sect]
   default_properties = fips=yes
   

   Ensure path/to/your/fipsmodule.cnf correctly points to the installed OpenSSL FIPS module.

4. Verify FIPS Module is Loaded
   Run:

   openssl fipsinstall -config /path/to/openssl.cnf

   If this fails, OpenSSL is not correctly built with FIPS.

5. Ensure Node Uses System OpenSSL
   By default, Node.js uses bundled OpenSSL. To force it to use your system OpenSSL, rebuild Node.js with:

   ./configure --shared-openssl --openssl-use-def-ca-store
   make -j$(nproc)
   sudo make install

6. Run Node.js in FIPS Mode
   Finally, try:

   NODE_OPTIONS="--enable-fips" node -p "crypto.getFips()"

   If everything is set up correctly, it should return 1.

Conclusion:

The issue is not a bug in Node.js, but rather a misconfigured OpenSSL setup. Updating openssl.cnf, verifying the FIPS module, and ensuring Node.js links to the correct OpenSSL should resolve the problem.

Let me know if you need further clarification!