node --force-fips does not work. Error openssl FIPS not a shared library.

[Lomilar]

Adding the following line to the Dockerfile:

node --force-fips

causes error:

 > [30/32] RUN node --force-fips:
0.660 node: OpenSSL error when trying to enable FIPS:
0.660 40920A7A3B7F0000:error:12800067:DSO support routines:dlfcn_load:could not load the shared library:../deps/openssl/openssl/crypto/dso/dso_dlfcn.c:118:filename(/home/node/node-v22.19.0/out/$(BUILDTYPE)/obj.target/deps/openssl/lib/openssl-modules/fips.so): Error loading shared library /home/node/node-v22.19.0/out/$(BUILDTYPE)/obj.target/deps/openssl/lib/openssl-modules/fips.so: No such file or directory

I'm interested in finding a solution, as I have a working node FIPS install based on node:24-slim -- Debian -- but would like to pursue alpine for security purposes.

For reference, that Dockerfile can be found here: https://github.com/cassproject/CASS/blob/master/docker/standalone/node/Dockerfile

[Lomilar]

I have a working version of alpine node w/openssl 3.1.2 here: https://github.com/cassproject/CASS/blob/master/docker/standalone/node/DockerfileAlpine

You may be able to adapt what I've done there to resolve this.

[keithboone]

@Lomilar Can you say what the root cause was for it not working and what fixes it?

[Lomilar]

The three substantive differences are in the ./configure, make, and the openssl config.

I'm afraid I cannot identify the change that fixes things, as I adapted the method I ultimately took from a debian FIPS (non-alpine node) installation (and I'm no OpenSSL expert, just a dev trying to get things NIST 800-53 compliant like the rest of us). I can summarize the changes though.

RUN ./Configure enable-fips
RUN make install
RUN make install_fips

---to---

    && ./Configure --prefix=/usr/local shared enable-fips enable-ec_nistp_64_gcc_128 \
    && make -j8 > make.log \
    && make install > makeinstall.log \
    && make install_ssldirs > makeinstallssldirs.log \
    && make install_fips > makeinstallfips.log \

and

.include /etc/ssl/fipsmodule.cnf

[openssl_init]
providers = provider_sect
alg_section = algorithm_sect

[algorithm_sect]
default_properties = fips=yes

# List of providers to load
[provider_sect]
fips = fips_sect
base = base_sect
default = default_sect

[base_sect]
activate = 1
---plus---
RUN awk '/^# For FIPS/ { print; system("cat /tmp/openssl_fips_insert.txt"); skip=1; next } \
     /^# fips = fips_sect/ { skip=0; next } \
     skip { next } \
     { print }' /etc/ssl/openssl.cnf > /etc/ssl/openssl.cnf.new

---to---

RUN echo "nodejs_conf = nodejs_init" >> /etc/ssl/nodejs.cnf && \
echo ".include /usr/local/ssl/fipsmodule.cnf" >> /etc/ssl/nodejs.cnf && \
echo "[nodejs_init]" >> /etc/ssl/nodejs.cnf && \
echo "providers = provider_sect" >> /etc/ssl/nodejs.cnf && \
echo "[provider_sect]" >> /etc/ssl/nodejs.cnf && \
echo "default = default_sect" >> /etc/ssl/nodejs.cnf && \
echo "fips = fips_sect" >> /etc/ssl/nodejs.cnf && \
echo "[default_sect]" >> /etc/ssl/nodejs.cnf && \
echo "activate = 1" >> /etc/ssl/nodejs.cnf