Certbot OpenSSL internal error: FATAL FIPS SELFTEST FAILURE at auto renew time

Help
1

My domain is:
www.vmatelier.com.br

I ran this command:
certbot certonly -d www.vmatelier.com.br --dry-run

It produced this output:
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Error while running nginx -c /etc/nginx/nginx.conf -t.

crypto/fips/fips.c:153: OpenSSL internal error: FATAL FIPS SELFTEST FAILURE

How would you like to authenticate with the ACME CA?

1: Nginx Web Server plugin (nginx) [Misconfigured]
2: Runs an HTTP server locally which serves the necessary validation files under
the /.well-known/acme-challenge/ request path. Suitable if there is no HTTP
server already running. HTTP challenge only (wildcards not supported).
(standalone)
3: Saves the necessary validation files to a .well-known/acme-challenge/
directory within the nominated webroot path. A separate HTTP server must be
running and serving files from the webroot path. HTTP challenge only (wildcards
not supported). (webroot)

Select the appropriate number [1-3] then [enter] (press 'c' to cancel):

My web server is (include version):
nginx version: nginx/1.21.5

The operating system my web server runs on is (include version):
openSUSE Leap 15.4

My hosting provider, if applicable, is:
Linode

I can login to a root shell on my machine (yes or no, or I don't know):
yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
certbot 3.2.0

Additional notes:

  • Certbot logs show the same error (OpenSSL internal error: FATAL FIPS SELFTEST FAILURE) at automatic renew time.
  • Previously it was executing autorenew seamslessly
  • There were no changes in openssl lybrary (v 1.1.1l-150400.7.7.1)
  • The same for pyopenssl (v 22.0.0)

Please help, site is off.

1 Like
2

Edit: server doesn't use FIPS; also, there is no requirement to use it.

3

In that case, perhaps disabling FIPS mode will help:

I'm not 100% sure, but I believe this type of error can occur when mixing FIPS and non-FIPS software.

3 Likes
4

Thank you for the reply.
FIPS isn't enabled in that machine, I don't know why this is happening. As I said, nothing regarding openssl or letsencrypt software has been changed in the server.

The error appears right after running "nginx -c /etc/nginx/nginx.conf -t".
Running the same at command line, however, works flawlessly.

5

Additionally, cat /proc/sys/crypto/fips_enabled show 0, not 1; cat /proc/cmdline doesn't include fips=1.

6

Your problem sounds similar to the one described below. Note that bmw in that thread is one of the Certbot developers.

Also note this thread possibly related with another suggested work-around

3 Likes
7

Thanks a lot! Changing the snap channel and updating certbot with the patched version has solved the issue.

2 Likes
8

Terrific!

You should have some kind of "health check" or monitoring for your site to warn you in advance about certificate expiration (and possibly other problems).

Here are some suggestions from Let's Encrypt: Monitoring Service Options - Let's Encrypt

5 Likes
9

I'll be doing it, thanks!

3 Likes