{"record":{"id":"277039aa0fc89279","repo":"fluent/fluentd","slug":"cannot-enable-fips-compliant-mode-openssl-fips-co","errorCode":null,"errorMessage":"Cannot enable FIPS compliant mode. OpenSSL FIPS configuration is disabled","messagePattern":"Cannot enable FIPS compliant mode\\. OpenSSL FIPS configuration is disabled","errorType":"exception","errorClass":"Fluent::ConfigError","httpStatus":null,"severity":"error","filePath":"lib/fluent/plugin_helper/cert_option.rb","lineNumber":42,"sourceCode":"  module PluginHelper\n    module CertOption\n      def cert_option_create_context(version, insecure, ciphers, conf)\n        cert, key, extra = cert_option_server_validate!(conf)\n\n        ctx = OpenSSL::SSL::SSLContext.new\n        # inject OpenSSL::SSL::SSLContext::DEFAULT_PARAMS\n        # https://bugs.ruby-lang.org/issues/9424\n        ctx.set_params({}) unless insecure\n\n        if conf.client_cert_auth\n          ctx.verify_mode = OpenSSL::SSL::VERIFY_PEER | OpenSSL::SSL::VERIFY_FAIL_IF_NO_PEER_CERT\n        else\n          ctx.verify_mode = OpenSSL::SSL::VERIFY_NONE\n        end\n\n        if conf.ensure_fips\n          unless OpenSSL.fips_mode\n            raise Fluent::ConfigError, \"Cannot enable FIPS compliant mode. OpenSSL FIPS configuration is disabled\"\n          end\n        end\n\n        ctx.ca_file = conf.ca_path\n        ctx.cert = cert\n        ctx.key = key\n        if extra && !extra.empty?\n          ctx.extra_chain_cert = extra\n        end\n        if conf.cert_verifier\n          sandbox = Class.new\n          ctx.verify_callback = if File.exist?(conf.cert_verifier)\n                                  verifier = File.read(conf.cert_verifier)\n                                  sandbox.instance_eval(verifier, File.basename(conf.cert_verifier))\n                                else\n                                  sandbox.instance_eval(conf.cert_verifier)\n                                end\n        end","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/fluent/fluentd/blob/dd45c6e18dc7be33b5e5a0f0767bf46307ff5626/lib/fluent/plugin_helper/cert_option.rb#L24-L60","documentation":"In cert_option_create_context (cert_option.rb:40-44), when the transport config sets ensure_fips true, fluentd verifies OpenSSL.fips_mode and raises this Fluent::ConfigError if the process is not actually in FIPS mode. ensure_fips is a guard (exposed by the server plugin helper for <transport tls>) that fails closed: it never switches OpenSSL into FIPS mode itself, it only asserts that the underlying OpenSSL library was built with FIPS support and activated via fips_mode, so a non-FIPS runtime cannot silently pretend to be compliant.","triggerScenarios":"Configuring <transport tls> with ensure_fips true on a host whose OpenSSL lacks FIPS support (most distro builds) or where FIPS was never activated via OPENSSL_CONF pointing at a fips-enabled openssl.cnf (fips_module conf + activate). Also when Ruby's openssl extension is linked against a non-FIPS-capable libcrypto, making OpenSSL.fips_mode return false.","commonSituations":"Compliance-driven deployments (government/finance) enabling ensure_fips without preparing the OpenSSL runtime; base images (debian/alpine) whose OpenSSL is compiled without FIPS; OpenShift/router or sidecar setups where the FIPS-enabled OpenSSL config is not mounted into the container; enabling FIPS on the kernel (fips=1) but not for the OpenSSL library used by Ruby.","solutions":["Verify the runtime first: ruby -ropenssl -e 'puts OpenSSL.fips_mode' must print true before ensure_fips can work","Install an OpenSSL build with FIPS support and set OPENSSL_CONF to an openssl.cnf that includes the fips_module block and activates it (e.g. .include /usr/openssl/fipsmodule.cnf + activate in ssl_conf), then restart fluentd in that environment","If FIPS is not actually required, remove ensure_fips true from <transport tls>","In containers, use a base image with a FIPS-capable OpenSSL and ensure the same env vars/config are passed to the fluentd process"],"exampleFix":"# before\n<transport tls>\n  ensure_fips true\n</transport>\n# on host without FIPS OpenSSL => Cannot enable FIPS compliant mode\n\n# after (non-FIPS deployment)\n<transport tls>\n  cert_path /etc/fluent/cert.pem\n  private_key_path /etc/fluent/key.pem\n</transport>\n\n# after (real FIPS need): prepare runtime, keep config\n# export OPENSSL_CONF=/etc/ssl/fips_enabled_openssl.cnf\n# ruby -ropenssl -e 'puts OpenSSL.fips_mode'  # => true","handlingStrategy":"validation","validationCode":"require 'openssl'\nif config_transport_sets?('ensure_fips', true)\n  raise 'OpenSSL not in FIPS mode; enable via FIPS-built OpenSSL + OPENSSL_CONF before running fluentd' unless OpenSSL.fips_mode\nend","typeGuard":null,"tryCatchPattern":"begin\n  agent.configure(conf)\nrescue Fluent::ConfigError => e\n  if e.message.include?('FIPS')\n    abort 'ensure_fips requires a FIPS-activated OpenSSL runtime (check OPENSSL_CONF / base image)'\n  end\n  raise\nend","preventionTips":["Pre-flight in the deployment environment: ruby -ropenssl -e 'exit(OpenSSL.fips_mode ? 0 : 1)' before enabling ensure_fips","Bake FIPS-capable OpenSSL and a fips-enabled openssl.cnf into the base image; pass OPENSSL_CONF to the fluentd process","Treat ensure_fips as a compliance assertion, not a switch — never 'fix' the error by removing it in FIPS-mandated environments without sign-off"],"tags":["fluentd","tls","openssl","fips","security","config-error","startup"],"backgroundTag":"fips-mode-not-available","analyzedSha":"dd45c6e18dc7be33b5e5a0f0767bf46307ff5626","analyzedAt":"2026-08-21T16:22:07.332Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}