Chef Server 12.15.8 secure LDAP does not function with kernel FIPS mode enabled

Chef Server 12.15.8 secure LDAP does not function with kernel FIPS mode enabled.

Expected Behavior

For now, Chef Server should detect kernel FIPS mode enabled and refuse to function in the case where secure LDAP is also enabled in chef-server.rb.

Current Behavior

Currently, Chef Server's LDAP module is unable to communicate with a standard AD setup over an encrypted channel port 636 when the Chef Server has FIPS mode enabled in the linux kernel

Steps to Reproduce (for bugs)

1. Install AD server with a working cert on port 636

2. Enable FIPS mode in the kernel (from dmesg after startup)

   Kernel command line: ro root=/dev/mapper/rootvg-lv_root rd_NO_LUKS LANG=en_US.UTF-8 rd_NO_MD SYSFONT=latarcyrheb-sun16 crashkernel=129M@48M rd_LVM_LV=rootvg/lv_root  KEYBOARDTYPE=pc KEYTABLE=us rd_NO_DM rd_LVM_LV=rootvg/lv_swap rhgb quiet  boot=/dev/sda1 fips=1
   fips mode: enabled
   

3. Install Chef Server and Manage and reconfigure with LDAP support enabled, pointing at the AD server on port 636

4. Attempt to login as a valid AD user through manage and the communication will fail in opscode-erchef's current or requests.log.X like

   [error] gen_*** <****> in state hello terminated with reason: call to undefined function 
   crypto**:generate***key******/2 from ssl_connection:*******/3 line 1531
   
   [error] CRASH REPORT Process <> with 0 neighbours exited with reason: call to undefined function 
   crypto**:generate***key*****(dh, [<<*******.>>,...]) in *******:terminate/7 line 626
   
   [error] Failed to connect to ldap host or an error occurred during connection setup. Please check 
   chef-server.rb for correct host, port, and encryption values: "connect failed"
   
   [error] Supervisor tls_connection_sup had child undefined started with 
   {tls_connection,start_link,undefined} at <*******> exit with reason call to undefined function 
   crypto**:generate***key(**, [<<*******,...>>,...]) in context child_terminated
   
   [error] {<<"method=POST; path=******/authenticate_user; status=504; ">>,"Gateway Timeout"}
   

Your Environment

• Chef Server Version:12.15.8
• Manage version: Any supported with 12.15.8
• Total/free RAM and disk space: N/A
• Operating System and Version: Any Chef Server supported OS

Start by reproducing the Chef Server 12.15.8 failure with kernel FIPS mode enabled and secure LDAP configured against an AD server on port 636. Read the opscode-erchef current or requests.log.X errors and the LDAP authentication path. Done means Chef Server detects the incompatible configuration and refuses to function instead of failing during encrypted LDAP communication.