fluent/fluentd · error · Fluent::ConfigError

Cannot enable FIPS compliant mode. OpenSSL FIPS configuratio

Error message

Cannot enable FIPS compliant mode. OpenSSL FIPS configuration is disabled

What it means

In cert_option_create_context (cert_option.rb:40-44), when the transport config sets ensure_fips true, fluentd verifies OpenSSL.fips_mode and raises this Fluent::ConfigError if the process is not actually in FIPS mode. ensure_fips is a guard (exposed by the server plugin helper for <transport tls>) that fails closed: it never switches OpenSSL into FIPS mode itself, it only asserts that the underlying OpenSSL library was built with FIPS support and activated via fips_mode, so a non-FIPS runtime cannot silently pretend to be compliant.

Source

Thrown at lib/fluent/plugin_helper/cert_option.rb:42

  module PluginHelper
    module CertOption
      def cert_option_create_context(version, insecure, ciphers, conf)
        cert, key, extra = cert_option_server_validate!(conf)

        ctx = OpenSSL::SSL::SSLContext.new
        # inject OpenSSL::SSL::SSLContext::DEFAULT_PARAMS
        # https://bugs.ruby-lang.org/issues/9424
        ctx.set_params({}) unless insecure

        if conf.client_cert_auth
          ctx.verify_mode = OpenSSL::SSL::VERIFY_PEER | OpenSSL::SSL::VERIFY_FAIL_IF_NO_PEER_CERT
        else
          ctx.verify_mode = OpenSSL::SSL::VERIFY_NONE
        end

        if conf.ensure_fips
          unless OpenSSL.fips_mode
            raise Fluent::ConfigError, "Cannot enable FIPS compliant mode. OpenSSL FIPS configuration is disabled"
          end
        end

        ctx.ca_file = conf.ca_path
        ctx.cert = cert
        ctx.key = key
        if extra && !extra.empty?
          ctx.extra_chain_cert = extra
        end
        if conf.cert_verifier
          sandbox = Class.new
          ctx.verify_callback = if File.exist?(conf.cert_verifier)
                                  verifier = File.read(conf.cert_verifier)
                                  sandbox.instance_eval(verifier, File.basename(conf.cert_verifier))
                                else
                                  sandbox.instance_eval(conf.cert_verifier)
                                end
        end

View on GitHub (pinned to dd45c6e18d)

Solutions

Verify the runtime first: ruby -ropenssl -e 'puts OpenSSL.fips_mode' must print true before ensure_fips can work
Install an OpenSSL build with FIPS support and set OPENSSL_CONF to an openssl.cnf that includes the fips_module block and activates it (e.g. .include /usr/openssl/fipsmodule.cnf + activate in ssl_conf), then restart fluentd in that environment
If FIPS is not actually required, remove ensure_fips true from <transport tls>
In containers, use a base image with a FIPS-capable OpenSSL and ensure the same env vars/config are passed to the fluentd process

Example fix

# before
<transport tls>
  ensure_fips true
</transport>
# on host without FIPS OpenSSL => Cannot enable FIPS compliant mode

# after (non-FIPS deployment)
<transport tls>
  cert_path /etc/fluent/cert.pem
  private_key_path /etc/fluent/key.pem
</transport>

# after (real FIPS need): prepare runtime, keep config
# export OPENSSL_CONF=/etc/ssl/fips_enabled_openssl.cnf
# ruby -ropenssl -e 'puts OpenSSL.fips_mode'  # => true

Defensive patterns

Strategy: validation

Validate before calling

require 'openssl'
if config_transport_sets?('ensure_fips', true)
  raise 'OpenSSL not in FIPS mode; enable via FIPS-built OpenSSL + OPENSSL_CONF before running fluentd' unless OpenSSL.fips_mode
end

Try / catch

begin
  agent.configure(conf)
rescue Fluent::ConfigError => e
  if e.message.include?('FIPS')
    abort 'ensure_fips requires a FIPS-activated OpenSSL runtime (check OPENSSL_CONF / base image)'
  end
  raise
end

Prevention

Pre-flight in the deployment environment: ruby -ropenssl -e 'exit(OpenSSL.fips_mode ? 0 : 1)' before enabling ensure_fips
Bake FIPS-capable OpenSSL and a fips-enabled openssl.cnf into the base image; pass OPENSSL_CONF to the fluentd process
Treat ensure_fips as a compliance assertion, not a switch — never 'fix' the error by removing it in FIPS-mandated environments without sign-off

When it happens

Trigger: Configuring <transport tls> with ensure_fips true on a host whose OpenSSL lacks FIPS support (most distro builds) or where FIPS was never activated via OPENSSL_CONF pointing at a fips-enabled openssl.cnf (fips_module conf + activate). Also when Ruby's openssl extension is linked against a non-FIPS-capable libcrypto, making OpenSSL.fips_mode return false.

Common situations: Compliance-driven deployments (government/finance) enabling ensure_fips without preparing the OpenSSL runtime; base images (debian/alpine) whose OpenSSL is compiled without FIPS; OpenShift/router or sidecar setups where the FIPS-enabled OpenSSL config is not mounted into the container; enabling FIPS on the kernel (fips=1) but not for the OpenSSL library used by Ruby.

Related errors

AI-assisted analysis of fluent/fluentd@dd45c6e18d (2026-08-21). Data as JSON: /api/errors/277039aa0fc89279. Report an issue: GitHub.