Chef: OpenSSL is not supported in FIPS MODE

[uCatu]

Description

Running Chef on FIPS enabled machine is throwing This version of OpenSSL does not support FIPS mode (OpenSSL::OpenSSLError)

For additional info see Slack thread:
https://chefcommunity.slack.com/archives/C0M1NGZE3/p1591598343224400

Chef Version

Tested on: 16.2.22, 14.9.13 & 16.1

Platform Version

RHEL Enterprise 8.2

Replication Case

Can use any FIPS enabled Image from dockerhub e.g:

• https://hub.docker.com/layers/ninefx/fips-go/1.0-ubuntu/images/sha256-1c6f34bd2282ac18bddafb2106a12ea3f7b7b440b9d9429da09ce3b1f322ee2a?context=explore
• https://hub.docker.com/layers/arhea/openssl-fips/2-ubuntu1804/images/sha256-1aff8619041cd34383eee3054806e426eed3f22fda383f1926f7301564806dba?context=explore

Spin it up on RHEL 8.2 EE FIPS enabled (amazon subscribed official AMI) instance with Docker EE (subscribed).

Invoking one bin from embedded or not, in this example chef-solo

Client Output + Stacktrace

root@5784c2af7389:/opt/chef/embedded/bin# ./chef-solo
[2020-06-10T07:03:46+00:00] WARN: No config file found or specified on command line. Using command line options instead.
Traceback (most recent call last):
    9: from ./chef-solo:23:in `<main>'
    8: from ./chef-solo:23:in `load'
    7: from /opt/chef/embedded/lib/ruby/gems/2.7.0/gems/chef-bin-16.1.16/bin/chef-solo:24:in `<top (required)>'
    6: from /opt/chef/embedded/lib/ruby/gems/2.7.0/gems/chef-16.1.16/lib/chef/application/solo.rb:55:in `run'
    5: from /opt/chef/embedded/lib/ruby/gems/2.7.0/gems/chef-16.1.16/lib/chef/application/solo.rb:67:in `reconfigure'
    4: from /opt/chef/embedded/lib/ruby/gems/2.7.0/gems/chef-16.1.16/lib/chef/application.rb:56:in `reconfigure'
    3: from /opt/chef/embedded/lib/ruby/gems/2.7.0/gems/chef-16.1.16/lib/chef/application.rb:101:in `configure_chef'
    2: from /opt/chef/embedded/lib/ruby/gems/2.7.0/gems/chef-config-16.1.16/lib/chef-config/config.rb:681:in `init_openssl'
    1: from /opt/chef/embedded/lib/ruby/gems/2.7.0/gems/chef-config-16.1.16/lib/chef-config/config.rb:1222:in `enable_fips_mode'
/opt/chef/embedded/lib/ruby/gems/2.7.0/gems/chef-config-16.1.16/lib/chef-config/config.rb:1222:in `fips_mode=': This version of OpenSSL does not support FIPS mode (OpenSSL::OpenSSLError)

While --no-fips flag allows chef-solo (or any other project) to work

root@5784c2af7389:/opt/chef/embedded/bin# ./chef-solo --no-fips
[2020-06-10T07:04:20+00:00] WARN: No config file found or specified on command line. Using command line options instead.
+---------------------------------------------+
            Chef License Acceptance

Before you can continue, 2 product licenses
must be accepted. View the license at
https://www.chef.io/end-user-license-agreement/

Licenses that need accepting:
  * Chef Infra Client
  * Chef InSpec

Do you accept the 2 product licenses (yes/no)?

View OS openssl and Embedded openssl versions:

root@5784c2af7389:/opt/chef/embedded/bin# ./openssl version
OpenSSL 1.0.2v  5 May 2020
root@5784c2af7389:/opt/chef/embedded/bin# openssl version
OpenSSL 1.0.2u-fips  20 Dec 2019

[uCatu]

It also looks like you are using CHEF_FIPS environment the wrong way, where FIPS is enabled iff value is 1:
https://github.com/chef/chef/blob/527658975c7d86caa298f4a8fc1d5345be178987/spec/support/platform_helpers.rb#L243

Where FIPS is enable for any value other than blank or if nil and OS if FIPS
https://github.com/chef/chef/blob/3889eddfc9944b23caea412d05c08b9b156cb50f/chef-config/lib/chef-config/config.rb#L665

[lamont-granquist]

CHEF_FIPS is entirely for internal testing and is only set in one place in the coede where its set to "1"

[tas50]

FIPS support errors should be resolved in 16.2.72 which should be shipping today