Mailing-List: contact bugs-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Apache HTTPD Bugs Notification List" <bugs@httpd.apache.org>
From: bugzilla@apache.org
To: bugs@httpd.apache.org
Subject: [Bug 60943] New: mod_ssl enables all of OpenSSL's built-in engines,
 even when in FIPS mode.
Date: Thu, 30 Mar 2017 18:27:07 +0000
Message-ID: <bug-60943-7868@https.bz.apache.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Auto-Submitted: auto-generated
MIME-Version: 1.0
archived-at: Thu, 30 Mar 2017 18:27:12 -0000

https://bz.apache.org/bugzilla/show_bug.cgi?id=3D60943

            Bug ID: 60943
           Summary: mod_ssl enables all of OpenSSL's built-in engines,
                    even when in FIPS mode.
           Product: Apache httpd-2
           Version: 2.4.25
          Hardware: PC
                OS: FreeBSD
            Status: NEW
          Severity: normal
          Priority: P2
         Component: mod_ssl
          Assignee: bugs@httpd.apache.org
          Reporter: stephen_wall@redcom.com
  Target Milestone: ---

FreeBSD (and OpenBSD) provide(s) a crypto accelerator device, /dev/crypto, =
for
which OpenSSL builds a built-in engine.

Apache's mod_ssl calls ENGINE_load_builtin_engines() as part of its startup,
resulting in that engine being active. For RSA operations, that engine calls
some OpenSSL internal RSA functions.  Those functions are not the FIPS
certified ones, resulting in a failure if FIPS has been enabled.  This means
Apache will reject all connections until it is reconfigured, either without
FIPS enabled, or with an EC certificate.

While I believe that the OpenSSL cryptodev engine should not be calling tho=
se
functions, I don't think mod_ssl should be arbitrarily enabling all the
built-in engines, even when FIPS mode has been turned on, since it has no
knowledge of whether those engines are FIPS certified.  Either don't call
ENGINE_load_builtin_engines() when in FIPS mode, or add a configuration opt=
ion
that allows users to choose for themselves whether or not
ENGINE_load_builtin_engines() is called.

--=20
You are receiving this mail because:
You are the assignee for the bug.=

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org