API Post Methods Fail on FIPS Servers

Description:

When navigating to the web page the web page fails to load. Looking at the developer console there are multiple POST requests to the server that get 400 responses. The response result is:

{"success":false,"error":"error:060800C8:digital envelope routines:EVP_DigestInit_ex:disabled for FIPS"}

Steps to reproduce:

1. Run a Linux (RHEL) server with FIPS=1
2. Install and setup Rocket.Chat
3. Navigate to the webpage.

Expected behavior:

See the initial webpage.

Actual behavior:

Get a grey page with a white box in the middle.

Server Setup Information:

• Version of Rocket.Chat Server:
• Operating System: RHEL 8.2 w/ FIPS enabled
• Deployment Method: tar
• Number of Running Instances: 1
• DB Replicaset Oplog: Yes
• NodeJS Version: 12.
• MongoDB Version: 4.4

Client Setup Information

• Desktop App or Browser Version:
  • Google Chrome | 84.0.4147.89 (Official Build) (32-bit)
  • Firefox 78.0.2esr (64-bit)
• Operating System: Windows 10

Additional context

I am pretty sure that this is caused by the use of MD5 hashes. Specifically Line 241 in /app/api/server/v1/misc.js

Looking at the code base it looks like there are a couple other references to MD5. It would be nice if everything could be moved off MD5 to at least sha1 or sha256. These may not be security related uses of MD5, but we can't run Rocket.Chat until it runs under FIPS.

Relevant logs:

Start at /app/api/server/v1/misc.js line 241 and inspect the other MD5 references in the codebase. Reproduce the failure on RHEL 8.2 with FIPS enabled, then verify that the POST requests no longer return the FIPS digest error and the initial webpage loads.