OpenSslCryptographicException issue with net8 -noble image

[pseudo42]

Has anyone experienced errors/exceptions with the openssl crypto library support in the dotnet/aspnet:8.0-noble images? We are seeing the following for the -noble image, although the Debian/bookworm default image works fine. We are unable to use the Debian/bookworm image for production deployments due to a couple of CRIT/HIGH vulnerabilities that will not be addressed by Debian.

Unhandled exception. Interop+Crypto+OpenSslCryptographicException: error:0308010C:digital envelope routines::unsupported
at Interop.Crypto.CheckValidOpenSslHandle(SafeHandle handle)
at System.Security.Cryptography.AesImplementation.CreateTransform(Byte[] rgbKey, Byte[] rgbIV, Boolean encrypting)

Ubuntu/noble image:

$ docker run --rm -it mcr.microsoft.com/dotnet/aspnet:8.0-noble openssl version
OpenSSL 3.0.13 30 Jan 2024 (Library: OpenSSL 3.0.13 30 Jan 2024)

$ docker run --rm -it mcr.microsoft.com/dotnet/aspnet:8.0-noble openssl ciphers
40B7EA11797F0000:error:12800067:DSO support routines:dlfcn_load:could not load the shared library:../crypto/dso/dso_dlfcn.c:118:filename(/usr/lib/x86_64-linux-gnu/ossl-modules/fips.so): /usr/lib/x86_64-linux-gnu/ossl-modules/fips.so: cannot open shared object file: No such file or directory
40B7EA11797F0000:error:12800067:DSO support routines:DSO_load:could not load the shared library:../crypto/dso/dso_lib.c:152:
40B7EA11797F0000:error:07880025:common libcrypto routines:provider_init:reason(524325):../crypto/provider_core.c:912:name=fips

Debian/bookworm image:

$ docker run --rm -it mcr.microsoft.com/dotnet/aspnet:8.0 openssl version
OpenSSL 3.0.15 3 Sep 2024 (Library: OpenSSL 3.0.15 3 Sep 2024)

$ docker run --rm -it mcr.microsoft.com/dotnet/aspnet:8.0 openssl ciphers
TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:RSA-PSK-AES256-GCM-SHA384:DHE-PSK-AES256-GCM-SHA384:RSA-PSK-CHACHA20-POLY1305:DHE-PSK-CHACHA20-POLY1305:ECDHE-PSK-CHACHA20-POLY1305:AES256-GCM-SHA384:PSK-AES256-GCM-SHA384:PSK-CHACHA20-POLY1305:RSA-PSK-AES128-GCM-SHA256:DHE-PSK-AES128-GCM-SHA256:AES128-GCM-SHA256:PSK-AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:ECDHE-PSK-AES256-CBC-SHA384:ECDHE-PSK-AES256-CBC-SHA:SRP-RSA-AES-256-CBC-SHA:SRP-AES-256-CBC-SHA:RSA-PSK-AES256-CBC-SHA384:DHE-PSK-AES256-CBC-SHA384:RSA-PSK-AES256-CBC-SHA:DHE-PSK-AES256-CBC-SHA:AES256-SHA:PSK-AES256-CBC-SHA384:PSK-AES256-CBC-SHA:ECDHE-PSK-AES128-CBC-SHA256:ECDHE-PSK-AES128-CBC-SHA:SRP-RSA-AES-128-CBC-SHA:SRP-AES-128-CBC-SHA:RSA-PSK-AES128-CBC-SHA256:DHE-PSK-AES128-CBC-SHA256:RSA-PSK-AES128-CBC-SHA:DHE-PSK-AES128-CBC-SHA:AES128-SHA:PSK-AES128-CBC-SHA256:PSK-AES128-CBC-SHA

[richlander]

Can you validate with a prior image, using our three-part version tags?

Which host are you running on?

[pseudo42]

Thanks for the quick response. I can try with a prior image. Do you have a recommended version to try?

This is currently running on an AWS EC2 Amazon Linux 2 instance using Docker Engine 25.0.8.

[richlander]

Possible same as: #5849

[lbussell]

The current versions are SDK 8.0.407 and ASP.NET Core 8.0.14. So the previous tags would be 8.0.406-noble and 8.0.13-noble respectively.

[pseudo42]

8.0.5 was the oldest available and appears to have the same OpenSSL library and issue.

I can try to (re-)install the openssl-fips library in a custom image build to see if that resolves our current problem.

$ docker run --rm -it mcr.microsoft.com/dotnet/aspnet:8.0.5-noble openssl version
Unable to find image 'mcr.microsoft.com/dotnet/aspnet:8.0.5-noble' locally
8.0.5-noble: Pulling from dotnet/aspnet
30a46ba9b681: Pull complete
a7d17098f6f5: Pull complete
110f36f67865: Pull complete
bb2619571df7: Pull complete
c67f95dc4b74: Pull complete
809d08bee989: Pull complete
Digest: sha256:5928bfa59f573e004d45a494ece8949aca833bfa009e0fc087a8c81c40e45efd
Status: Downloaded newer image for mcr.microsoft.com/dotnet/aspnet:8.0.5-noble
OpenSSL 3.0.13 30 Jan 2024 (Library: OpenSSL 3.0.13 30 Jan 2024)

$ docker run --rm -it mcr.microsoft.com/dotnet/aspnet:8.0.5-noble openssl ciphers
4067CB86B47F0000:error:12800067:DSO support routines:dlfcn_load:could not load the shared library:../crypto/dso/dso_dlfcn.c:118:filename(/usr/lib/x86_64-linux-gnu/ossl-modules/fips.so): /usr/lib/x86_64-linux-gnu/ossl-modules/fips.so: cannot open shared object file: No such file or directory
4067CB86B47F0000:error:12800067:DSO support routines:DSO_load:could not load the shared library:../crypto/dso/dso_lib.c:152:
4067CB86B47F0000:error:07880025:common libcrypto routines:provider_init:reason(524325):../crypto/provider_core.c:912:name=fips

[richlander]

I do not see this. I am guessing that it is specific to the environment. We do not offer FIPS-related support. We don't have the experience. As you can see from the other issue, we relied on FIPS experts to help us.

Are you intending to run with FIPS enabled? It seems like there is a missing shared object. Are there EC2 or Amazon Linux docs on how to do FIPS?

rich@mazama:~$ docker run --rm -it mcr.microsoft.com/dotnet/aspnet:8.0-noble openssl ciphers
TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:RSA-PSK-AES256-GCM-SHA384:DHE-PSK-AES256-GCM-SHA384:RSA-PSK-CHACHA20-POLY1305:DHE-PSK-CHACHA20-POLY1305:ECDHE-PSK-CHACHA20-POLY1305:AES256-GCM-SHA384:PSK-AES256-GCM-SHA384:PSK-CHACHA20-POLY1305:RSA-PSK-AES128-GCM-SHA256:DHE-PSK-AES128-GCM-SHA256:AES128-GCM-SHA256:PSK-AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:ECDHE-PSK-AES256-CBC-SHA384:ECDHE-PSK-AES256-CBC-SHA:SRP-RSA-AES-256-CBC-SHA:SRP-AES-256-CBC-SHA:RSA-PSK-AES256-CBC-SHA384:DHE-PSK-AES256-CBC-SHA384:RSA-PSK-AES256-CBC-SHA:DHE-PSK-AES256-CBC-SHA:AES256-SHA:PSK-AES256-CBC-SHA384:PSK-AES256-CBC-SHA:ECDHE-PSK-AES128-CBC-SHA256:ECDHE-PSK-AES128-CBC-SHA:SRP-RSA-AES-128-CBC-SHA:SRP-AES-128-CBC-SHA:RSA-PSK-AES128-CBC-SHA256:DHE-PSK-AES128-CBC-SHA256:RSA-PSK-AES128-CBC-SHA:DHE-PSK-AES128-CBC-SHA:AES128-SHA:PSK-AES128-CBC-SHA256:PSK-AES128-CBC-SHA
rich@mazama:~$ cat /etc/os-release | head -n 1
PRETTY_NAME="Ubuntu 24.04.2 LTS"

[pseudo42]

openssl-fips is not available in the default repos configured for the -noble image, so the re-install failed.