linuxopensslfips

EE Certificate key too weak error in Openssl 3.1.0 FIPS enabled

I had compiled Openssl 3.1.0 with fips using the below given scripts. Installation is successful and works fine. But if FIPS enabled then not able to make any outbound connections, getting EE certificate too week error.

wget https://www.openssl.org/source/openssl-3.1.0.tar.gz \
    && tar zxvf openssl-3.1.0.tar.gz \
    && cd openssl-3.1.0 \
    && CFLAGS=-fPIC ./config enable-fips --prefix=/usr/local/openssl --openssldir=/usr/local/openssl \
    && make \
    && make test \
    && make install \
    && bash -c "echo '/usr/local/openssl/lib64' >> /etc/ld.so.conf" \
    && ldconfig

openssl version
OpenSSL 3.1.0 14 Mar 2023 (Library: OpenSSL 3.1.0 14 Mar 2023)

Enabled FIPS by including the fipsmodule.cnf file in the openssl config, and by adding fips providers.

.include /usr/local/openssl/fipsmodule.cnf

..
..
..

# List of providers to load
[provider_sect]
default = default_sect

# The fips section name should match the section name inside the
# included fipsmodule.cnf.
fips = fips_sect

Verified FIPS enabled by generating MD5 hash for a file, as expected got error.

openssl md5 <file_path>
Error setting digest
40C7F61E7D7F0000:error:0308010C:digital envelope routines:(unknown function):unsupported:crypto/evp/evp_fetch.c:341:Global default library context, Algorithm (MD5 : 100), Properties ()
40C7F61E7D7F0000:error:03000086:digital envelope routines:(unknown function):initialization error:crypto/evp/digest.c:272:
# 
# 
openssl sha256 <file_path>
SHA2-256(openssl)= 49c16340d51eba8d2c31dbe569ad1f686fef571a0a7c9a4545a85c22d4650259
[root@centos7 bin]#

But all outbound connections are failing,

openssl s_client -connect google.com:443

CONNECTED(00000003)
depth=0 CN = *.google.com
verify error:num=66:EE certificate key too weak
verify return:1
depth=0 CN = *.google.com
verify error:num=66:EE certificate key too weak
verify return:1
40D7CF19B37F0000:error:03000072:digital envelope routines:(unknown function):decode error:crypto/x509/x_pubkey.c:458:
40D7CF19B37F0000:error:0A0000EF:SSL routines:(unknown function):unable to find public key parameters:ssl/statem/statem_clnt.c:1905:
---
Certificate chain
 0 s:CN = *.google.com
   i:C = US, O = Google Trust Services LLC, CN = GTS CA 1C3
   v:NotBefore: Mar 28 16:47:33 2023 GMT; NotAfter: Jun 20 16:47:32 2023 GMT
 1 s:C = US, O = Google Trust Services LLC, CN = GTS CA 1C3
   i:C = US, O = Google Trust Services LLC, CN = GTS Root R1
   v:NotBefore: Aug 13 00:00:42 2020 GMT; NotAfter: Sep 30 00:00:42 2027 GMT
 2 s:C = US, O = Google Trust Services LLC, CN = GTS Root R1
   i:C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
   v:NotBefore: Jun 19 00:00:42 2020 GMT; NotAfter: Jan 28 00:00:42 2028 GMT
---
no peer certificate available
---
No client certificate CA names sent
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 6777 bytes and written 311 bytes
Verification error: EE certificate key too weak
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
This TLS version forbids renegotiation.
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 66 (EE certificate key too weak)
---

Any help to resolve this issue, thanks.

Solution

  • 40D7CF19B37F0000:error:03000072:digital envelope routines:(unknown function):decode error:crypto/x509/x_pubkey.c:458:

    I was trying to install openssl-3.1.0 with FIPS hardening and and had ran into an issue since the FIPS provider by default does not load an encoder/decoder -

    Sample logs to show the failure -

    # openssl genrsa 2048
00446BBEC97F0000:error:1D800065:ENCODER routines:OSSL_ENCODER_to_bio:reason(101):crypto/encode_decode/encoder_lib.c:55:No encoders were found. For standard encoders you need at l
east one of the default or base providers available. Did you forget to load them?
00446BBEC97F0000:error:04800073:PEM routines:do_pk8pkey:error converting private key:crypto/pem/pem_pk8.c:133:

    For details, you may refer https://www.openssl.org/docs/man3.0/man7/fips_module.html.

    What worked for me was to enable the default provider with "fips=yes" as defined in the example config.

    
.include /usr/local/ssl/fipsmodule.cnf

[openssl_init]
providers = provider_sect
alg_section = algorithm_sect

[provider_sect]
fips = fips_sect
default = default_sect

[default_sect]
activate = 1

[algorithm_sect]
default_properties = fips=yes

    I would recommend trying to add "algorithm_sect" to your conf and see if it resolves your issue.

    # openssl3 md5 data/hsm_config
Error setting digest
0054D1E67E7F0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:crypto/evp/evp_fetch.c:341:Global default library context, Algorithm (MD5 : 100), Properties ()
0054D1E67E7F0000:error:03000086:digital envelope routines:evp_md_init_internal:initialization error:crypto/evp/digest.c:272:

## openssl genrsa 2048
-----BEGIN PRIVATE KEY-----
....
-----END PRIVATE KEY-----