Description

Cryptographic functions using OpenSSL fail when running in a container based on Ubuntu 24.04 (Noble) running on a Linux kernel with FIPS enabled. OpenSSL tries to load its fips module, which is not present in the container. When calling a crypto function in .NET, the result is an interop exception.

See https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/2056593 for Ubuntu adding the kernel FIPS detection.

Reproduction Steps

1. Build a container in .NET 8 with the noble family with this program:

   using System.Security.Cryptography;
   using System.Text;
   
   var builder = WebApplication.CreateBuilder(args);
   var app = builder.Build();
   
   app.MapGet("/", (string? message) => message ?? "Hello World!");
   app.MapGet("/hash", (string? message) => Convert.ToBase64String(SHA384.HashData(Encoding.UTF8.GetBytes(message     ?? "Hello World!"))));
   app.MapGet("/env", () => new EnvironmentInfo());
   
   app.Run();
   

   Code and prebuilt container images available at https://github.com/ddunkin/EchoServer.

2. Run the container on a kernel with FIPS enabled.

3. Hit the /hash route.

Expected behavior

The route should return a hash of the message.

Actual behavior

Interop+Crypto+OpenSslCryptographicException: error:03000086:digital envelope routines::initialization error
   at System.Security.Cryptography.HashProviderDispenser.OneShotHashProvider.HashData(String hashAlgorithmId, ReadOnlySpan`1 source, Span`1 destination)
   at System.Security.Cryptography.SHA384.TryHashData(ReadOnlySpan`1 source, Span`1 destination, Int32& bytesWritten)
   at System.Security.Cryptography.SHA384.HashData(ReadOnlySpan`1 source, Span`1 destination)
   at System.Security.Cryptography.SHA384.HashData(ReadOnlySpan`1 source)
   at System.Security.Cryptography.SHA384.HashData(Byte[] source)

Regression?

No response

Known Workarounds

Set OPENSSL_FORCE_FIPS_MODE=0 in the environment in the container.

Configuration

dotnet publish built container
.NET 8.0
Ubuntu 24.04
x64
FIPS enabled in the kernel

We're seeing this in some Azure Container Apps environments where we don't have control of the kernel.

Other information

I set OPENSSL_FORCE_FIPS_MODE in my container with this in my csproj:

  <ItemGroup>
    <!--
    OpenSSL detects FIPS support in the Linux kernel in Ubuntu 24.04, but the container does not contain the FIPS module.
    https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/2056593
    This causes .NET cryptographic functions that use OpenSSL to fail in imabes based on Ubuntu 24.04 (noble).
    This environment variable disables FIPS mode in OpenSSL.
    -->
    <ContainerEnvironmentVariable Include="OPENSSL_FORCE_FIPS_MODE" Value="0" />
  </ItemGroup>

Consider setting OPENSSL_FORCE_FIPS_MODE=0 in all noble base images. If someone wants FIPS support, they have to add customize the image to add the libraries anyway and can override the environment variable then.