Certbot OpenSSL internal error: FATAL FIPS SELFTEST FAILURE at auto renew time

MikeMcQ · March 8, 2025, 12:35am

Your problem sounds similar to the one described below. Note that bmw in that thread is one of the Certbot developers.

github.com/certbot/certbot

Certbot halts while renewing because can't start Nginx: `/snap/certbot/4412/usr/lib/x86_64-linux-gnu/ossl-modules/fips.so`: No such file or directory error

opened 12:11PM - 13 Feb 25 UTC

closed 09:21PM - 06 Mar 25 UTC

Vanav

has pr

## My operating system is (include version) CentOS 9.5 (Oracle Linux), Certbot 3….2.0 (snap), Nginx 1.26.2 (nginx.org repository). Certbot is installed using Snap as [the recommended way](https://eff-certbot.readthedocs.io/en/latest/install.html). ## I ran this command and it produced this output `certbot renew`: > 2025-02-13 13:26:13,598:DEBUG:certbot._internal.plugins.selection:Requested authenticator nginx and installer nginx Certbot halts on this line. Nginx `error.log`: > 2025/02/13 13:26:13 [alert] 138461#138461: OPENSSL_init_ssl() failed (SSL: error:12800067:DSO support routines::could not load the shared library:filename(/snap/certbot/4412/usr/lib/x86_64-linux-gnu/ossl-modules/fips.so): /snap/certbot/4412/usr/lib/x86_64-linux-gnu/ossl-modules/fips.so: cannot open shared object file: No such file or directory error:12800067:DSO support routines::could not load the shared library error:07880025:common libcrypto routines::reason(37):name=fips error:0700006D:configuration file routines::module initialization error:module=providers, value=provider_sect retcode=-1 ) Nginx halts on this line with 100% one core CPU usage. ## Certbot's behavior and environment Nginx halts with 100% one core CPU usage, and Certbot halts too waiting for Nginx. Contents of directories: ``` # ls -al /snap/certbot/current/usr/lib/x86_64-linux-gnu/ossl-modules -rw-r--r-- 1 root root 133584 Feb 11 23:18 legacy.so # ls -al /usr/lib64/ossl-modules -rwxr-xr-x 1 root root 1337160 Nov 13 01:52 fips.so -rwxr-xr-x 1 root root 136336 Oct 30 16:38 legacy.so ``` FIPS status on OS: ``` # fips-mode-setup --check Installation of FIPS modules is not completed. FIPS mode is disabled. # cat /proc/sys/crypto/fips_enabled 0 ``` ## Workaround `/etc/fstab`: ``` /usr/lib64/ossl-modules /snap/certbot/current/usr/lib/x86_64-linux-gnu/ossl-modules none bind 0 0 ``` Not a stable workaround, because when Certbot autoupdates, `fips.so` will be missing again. ## Discussion This issue reported by multiple users: https://community.letsencrypt.org/t/certbot-snap-error-while-renewing-openssl-init-ssl/232145 Maybe related and more discussion: #10044.

Also note this thread possibly related with another suggested work-around

Topic		Replies	Views
Certbot snap Error while renewing (OPENSSL_init_ssl) Help	29	1383	March 7, 2025
Supposed Nginx misconfiguration stops certbot from working Help	17	800	March 18, 2025
Certbot failing with problem with openSSL Configuration Help	14	1601	December 18, 2024
Unable to renew my certificates Help	5	283	December 2, 2024
OpenSSL in FIPS Mode does not have MD5 Hash Functionality Required by Certbot Help	2	4239	December 26, 2017

Certbot OpenSSL internal error: FATAL FIPS SELFTEST FAILURE at auto renew time

Related topics