<div dir="ltr"><div>I just created <a href="https://github.com/openssl/openssl/issues/12496">https://github.com/openssl/openssl/issues/12496</a> for this.</div><div><br></div><div><br></div><div>Regards,</div><div>Tom.III</div><div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, Jul 18, 2020 at 1:06 AM Dr. Matthias St. Pierre <<a href="mailto:Matthias.St.Pierre@ncp-e.com">Matthias.St.Pierre@ncp-e.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="DE">
<div class="gmail-m_-6863393500299898549WordSection1">
<p class="MsoNormal"><span lang="EN-US">Thomas,<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">> I consider this a bug, of course, but at least now I know what's causing it and how to work around it.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">thanks for sharing your analysis. Would you mind creating a
GitHub issue for the hang?<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
<p class="MsoNormal"><a href="https://github.com/openssl/openssl/issues" target="_blank"><span lang="EN-US">https://github.com/openssl/openssl/issues</span></a><span lang="EN-US"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
<p class="MsoNormal">Matthias<u></u><u></u></p>
<p class="MsoNormal"><span><u></u> <u></u></span></p>
<p class="MsoNormal"><span><u></u> <u></u></span></p>
<div style="border-color:currentcolor currentcolor currentcolor blue;border-style:none none none solid;border-width:medium medium medium 1.5pt;padding:0cm 0cm 0cm 4pt">
<p style="font-size:10pt;font-family:Calibri,Arial"><span style="font-size:11pt"></span> </p>
<p style="font-size:10pt;font-family:Calibri,Arial"><span style="font-size:11pt">
</span></p><table style="height:342px;width:620px">
<tbody>
<tr>
<td style="font-size:11pt;height:127px;font-family:Calibri,Arial;width:171px" valign="top">
<span style="font-size:11pt"><span style="font-size:11pt"><span style="font-size:11pt"><span style="font-size:11pt"><b><img style="height: 56px; width: 154px;" alt="NCP engingeering GmbH" src="cid:1736d5630228334e7f91" width="153" height="56" border="0"></b></span></span></span></span></td>
<td style="font-size:11pt;height:25px;font-family:Calibri,Arial;width:12px" valign="top">
<span style="font-size:11pt"><span style="font-size:11pt"><b></b></span></span></td>
<td style="font-size:11pt;height:25px;font-family:Calibri,Arial;width:501px" valign="top">
<span style="font-size:11pt"><span style="font-size:11pt"><b>Dr. Matthias St. Pierre</b>
<br>
<span style="font-size:11pt"><span style="font-size:11pt"><br>
Senior Software Engineer <br>
<a href="mailto:matthias.st.pierre@ncp-e.com" target="_blank">matthias.st.pierre@ncp-e.com</a> <br>
Phone: +49 911 9968-0<br>
<a href="http://www.ncp-e.com" target="_blank">www.ncp-e.com</a> </span></span></span></span></td>
</tr>
<tr>
<td style="font-size:11pt;height:25px;font-family:Calibri,Arial;width:684px" colspan="3" valign="top">
<p style="font-size:10pt;font-family:Calibri,Arial"><b><br>
Follow us on:</b> <a title="" href="https://www.facebook.com/NCPengineering" target="_blank">Facebook</a> |
<a href="https://twitter.com/NCP_engineering" target="_blank">Twitter</a> | <a href="https://www.xing.com/companies/ncpengineeringgmbh" target="_blank">
Xing</a> | <a href="https://www.youtube.com/user/NCPengineeringGmbH" target="_blank">YouTube</a> |
<a href="http://www.linkedin.com/company/ncp-engineering-inc.?trk=cws-cpw-coname-0-0" target="_blank">
LinkedIn</a><br>
<br>
<b>Headquarters Germany: </b>NCP engineering GmbH • Dombuehler Str. 2 • 90449 • Nuremberg
<br>
<b>North American HQ:</b> NCP engineering Inc. • 601 Cleveland Str., Suite 501-25 • Clearwater, FL 33755
<br>
<br>
Authorized representatives: Peter Soell, Patrick Oliver Graf, Beate Dietrich <br>
Registry Court: Lower District Court of Nuremberg <br>
Commercial register No.: HRB 7786 Nuremberg, VAT identification No.: DE 133557619
<span style="font-family:Calibri"></span></p>
<p style="font-size:10pt;font-family:Calibri,Arial"><span style="font-size:7pt;font-family:Calibri,Arial"><font style="font-size:7pt" color="#727272">This e-mail message including any attachments is for the sole use of the intended recipient(s) and
may contain privileged or confidential information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply e-mail and delete the original message and destroy
all copies thereof.</font> </span></p>
</td>
</tr>
</tbody>
</table>
<span style="font-family:Arial"></span><p></p>
<span style="font-size:12pt"></span><span style="font-family:Times New Roman"><span style="font-size:12pt"></span></span><span style="font-family:Arial"><span style="font-size:12pt"><a href="https://www.ncp-e.com/de/aktuelles/events/veranstaltungen" target="_blank"></a></span></span><a title="" href="https://www.ncp-e.com/de/aktuelles/events/veranstaltungen" target="_blank"></a>
<p style="font-size:10pt;font-family:Arial"></p>
<p style="font-size:10pt;font-family:Arial"></p>
<div>
<div style="border-color:rgb(225,225,225) currentcolor currentcolor;border-style:solid none none;border-width:1pt medium medium;padding:3pt 0cm 0cm">
<p class="MsoNormal"><b><span>From:</span></b><span> openssl-users <<a href="mailto:openssl-users-bounces@openssl.org" target="_blank">openssl-users-bounces@openssl.org</a>>
<b>On Behalf Of </b>Thomas Dwyer III<br>
<b>Sent:</b> Friday, July 17, 2020 6:57 PM<br>
<b>To:</b> openssl-users <<a href="mailto:openssl-users@openssl.org" target="_blank">openssl-users@openssl.org</a>><br>
<b>Subject:</b> [SOLVED] Re: OpenSSL 3.0 hangs at exit with FIPS provider<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">It turns out the problem was caused by a misinterpretation of the phrase "add the following lines near the beginning" in section 7.1 of the documentation at
<a href="https://wiki.openssl.org/index.php/OpenSSL_3.0" target="_blank">https://wiki.openssl.org/index.php/OpenSSL_3.0</a> for enabling FIPS support. I added these lines to the very top of the file:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div style="margin-left:30pt">
<pre><span style="color:blue">openssl_conf = openssl_init<u></u><u></u></span></pre>
<pre><span style="color:blue"><u></u> <u></u></span></pre>
<pre><span style="color:blue">.include /usr/local/ssl/fipsmodule.cnf<u></u><u></u></span></pre>
<pre><span style="color:blue"><u></u> <u></u></span></pre>
<pre><span style="color:blue">[openssl_init]<u></u><u></u></span></pre>
<pre><span style="color:blue">providers = provider_sect<u></u><u></u></span></pre>
<pre><span style="color:blue"><u></u> <u></u></span></pre>
<pre><span style="color:blue">[provider_sect]<u></u><u></u></span></pre>
<pre><span style="color:blue">fips = fips_sect</span><u></u><u></u></pre>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">This caused the existing default section to now become part of the [provider_sect] section. Apparently any name=value line in that particular section where no [value] section exists causes OpenSSL to hang at exit when the FIPS provider
is used. I consider this a bug, of course, but at least now I know what's causing it and how to work around it.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Regarding how to confirm which provider is actually providing a given algorithm, I found that EVP_MD_provider() returns NULL for any EVP_MD obtained via EVP_get_digestbyname() (even after it's used successfully by EVP_DigestInit_ex()) but
it returns a valid OSSL_PROVIDER for any EVP_MD obtained via EVP_MD_fetch(). Is this intentional?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Tom.III<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
</div>
</div>
</blockquote></div></div>