Repository: node
Issue: Test failures with FIPS enabled
Labels: crypto,test

# Background

Previously we used to have a CI configuration for testing Node.js with FIPS enabled back when we were using OpenSSL 1.0.2. We stopped in Node.js 10.x when we moved to OpenSSL 1.1.x as there was no upstream OpenSSL support for FIPS in that version. With OpenSSL 3, FIPS is back, this time as an [OpenSSL 3 provider](https://github.com/nodejs/node/blob/main/doc/api/crypto.md#fips-mode).

I've started work on re-adding a FIPS enabled configuration to our CI. For now this is in a temporary [separate job](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/) as there are test failures.

[richardlau-node-test-commit-linux-containered](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/) is based on [node-test-commit-linux-containered](https://ci.nodejs.org/job/node-test-commit-linux-containered/) with extra configurations, one of which, [ubuntu2204_sharedlibs_openssl30fips_x64](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/), is for FIPS enablement with OpenSSL 3. I've put together a slimmed down version of the container we're using in https://github.com/richardlau/ubuntu2204_fips for replication outside of the CI.

## List of failing tests with FIPS enabled

e.g. https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64
(on https://github.com/nodejs/node/commit/a9295223753672d009ed614abe3fc3c4f2d1f403)

- [parallel.test-crypto-fips](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_crypto_fips/) https://github.com/nodejs/node/pull/48392
- [parallel.test-crypto-key-objects](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_crypto_key_objects/)
- [parallel.test-crypto-worker-thread](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_crypto_worker_thread/)
- [addons.openssl-providers.test-legacy-provider-config](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/addons/openssl-providers/test_legacy_provider_config/)
- [parallel.test-crypto](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_crypto/)
- [parallel.test-crypto-authenticated-stream](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_crypto_authenticated_stream/)
- [parallel.test-crypto-certificate](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_crypto_certificate/)
- [parallel.test-crypto-async-sign-verify](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_crypto_async_sign_verify/)
- [parallel.test-crypto-authenticated](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_crypto_authenticated/)
- [parallel.test-crypto-des3-wrap](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_crypto_des3_wrap/)
- [parallel.test-crypto-dh-stateless](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_crypto_dh_stateless/)
- [parallel.test-crypto-getcipherinfo](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_crypto_getcipherinfo/)
- [parallel.test-crypto-key-objects-messageport](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_crypto_key_objects_messageport/)
- [parallel.test-crypto-keygen](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_crypto_keygen/)
- [parallel.test-crypto-keygen-deprecation](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_crypto_keygen_deprecation/)
- [parallel.test-crypto-no-algorithm](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_crypto_no_algorithm/)
- [parallel.test-crypto-private-decrypt-gh32240](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_crypto_private_decrypt_gh32240/)
- [parallel.test-crypto-dh-odd-key](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_crypto_dh_odd_key/)
- [parallel.test-crypto-rsa-dsa](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_crypto_rsa_dsa/)
- [parallel.test-crypto-scrypt](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_crypto_scrypt/)
- [parallel.test-crypto-sign-verify](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_crypto_sign_verify/)
- [parallel.test-https-agent-additional-options](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_https_agent_additional_options/)
- [parallel.test-https-agent-session-eviction](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_https_agent_session_eviction/)
- [parallel.test-https-pfx](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_https_pfx/)
- [parallel.test-tls-alert](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_tls_alert/)
- [parallel.test-tls-cli-max-version-1.3](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_tls_cli_max_version_1_3/)
- [parallel.test-tls-cli-max-version-1.2](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_tls_cli_max_version_1_2/)
- [parallel.test-tls-cli-min-version-1.1](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_tls_cli_min_version_1_1/)
- [parallel.test-tls-cli-min-version-1.0](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_tls_cli_min_version_1_0/)
- [parallel.test-tls-cli-min-version-1.3](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_tls_cli_min_version_1_3/)
- [parallel.test-tls-cli-min-version-1.2](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_tls_cli_min_version_1_2/)
- [parallel.test-tls-client-getephemeralkeyinfo](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_tls_client_getephemeralkeyinfo/)
- [parallel.test-tls-client-mindhsize](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_tls_client_mindhsize/)
- [parallel.test-tls-ecdh-multiple](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_tls_ecdh_multiple/)
- [parallel.test-tls-dhe](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_tls_dhe/)
- [parallel.test-tls-getprotocol](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_tls_getprotocol/)
- [parallel.test-tls-multi-key](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_tls_multi_key/)
- [parallel.test-tls-multi-pfx](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_tls_multi_pfx/)
- [parallel.test-tls-min-max-version](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_tls_min_max_version/)
- [parallel.test-tls-passphrase](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_tls_passphrase/)
- [parallel.test-tls-pfx-authorizationerror](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_tls_pfx_authorizationerror/)
- [parallel.test-tls-session-cache](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_tls_session_cache/)
- [parallel.test-tls-set-ciphers](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_tls_set_ciphers/)
- [parallel.test-tls-write-error](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_tls_write_error/)
- [parallel.test-webcrypto-export-import](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_webcrypto_export_import/)
- [parallel.test-webcrypto-keygen](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_webcrypto_keygen/)
- [parallel.test-webcrypto-sign-verify-ecdsa](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_webcrypto_sign_verify_ecdsa/)
- [parallel.test-webcrypto-sign-verify-eddsa](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_webcrypto_sign_verify_eddsa/)
- [parallel.test-webcrypto-sign-verify-hmac](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_webcrypto_sign_verify_hmac/)
- [parallel.test-webcrypto-sign-verify-rsa](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_webcrypto_sign_verify_rsa/)
- [parallel.test-webcrypto-sign-verify](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_webcrypto_sign_verify/)
- [parallel.test-webcrypto-wrap-unwrap](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/parallel/test_webcrypto_wrap_unwrap/)
- [sequential.test-async-wrap-getasyncid](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/sequential/test_async_wrap_getasyncid/)
- [wpt.test-webcrypto](https://ci.nodejs.org/job/richardlau-node-test-commit-linux-containered/14/nodes=ubuntu2204_sharedlibs_openssl30fips_x64/testReport/junit/(root)/wpt/test_webcrypto/)

cc @nodejs/crypto