New OpenSSL requirements in RHEL 9 in fips mode [RHSA-2023:3722-01], cannot connect to Chef Server anymore with no EMS support

Chef Server Version

Chef Server 15.7.0 el9

Platform Details

Rocky Linux 9.2 / RHEL 9.2

Scenario

After RHEL 9/Rocky Linux 9 released

Steps to Reproduce

RHEL/Rocky Linux/Alama Linux 9 has released security update RHSA-2023:3722-01 [ https://lwn.net/Articles/935817/ ] which prevents clients (who are also in fips mode) from connecting to the Chef server when running in FIPS mode. The new updates forces EMS support which is ONLY supported in Openssl 1.1+ or higher and won't work with Opensll 1.0.xx which has already been deprecated for awhile. Since Chef Server [chef-server-core-15.7.0-1.el9.x86_64.rpm or chef-server-core-15.7.0-1.el8.x86_64.rpm] is using it's own openssl 1.0.x version which is not compatible as stated in the RHEL release notes [ https://access.redhat.com/solutions/7018256 ]

/opt/opscode/embedded/sbin/nginx -V
nginx version: openresty/1.21.4.1rc1
built with OpenSSL 1.0.2zg-fips  7 Feb 2023
TLS SNI support enabled
configure arguments: --prefix=/opt/opscode/embedded/nginx --with-debug --with-cc-opt='-DNGX_LUA_USE_ASSERT -DNGX_LUA_ABORT_AT_PANIC -O2 -L/opt/opscode/embedded/lib -I/opt/opscode/embedded/include' --add-module=../ngx_devel_kit-0.3.1 --add-module=../echo-nginx-module-0.62 --add-module=../xss-nginx-module-0.06 --add-module=../ngx_coolkit-0.2 --add-module=../set-misc-nginx-module-0.33 --add-module=../form-input-nginx-module-0.12 --add-module=../encrypted-session-nginx-module-0.09 --add-module=../srcache-nginx-module-0.32 --add-module=../ngx_lua-0.10.21rc1 --add-module=../ngx_lua_upstream-0.07 --add-module=../headers-more-nginx-module-0.33 --add-module=../array-var-nginx-module-0.05 --add-module=../memc-nginx-module-0.19 --add-module=../redis2-nginx-module-0.15 --add-module=../redis-nginx-module-0.3.9 --add-module=../rds-json-nginx-module-0.15 --add-module=../rds-csv-nginx-module-0.09 --add-module=../ngx_stream_lua-0.0.11rc1 --with-ld-opt='-Wl,-rpath,/opt/opscode/embedded/luajit/lib -L/opt/opscode/embedded/lib -Wl,-rpath,/opt/opscode/embedded/lib -lssl -lcrypto -ldl -lz' --sbin-path=/opt/opscode/embedded/sbin/nginx --conf-path=/opt/opscode/embedded/conf/nginx.conf --with-http_ssl_module --with-http_stub_status_module --with-md5-asm --with-sha1-asm --with-pcre-jit --without-http_ssi_module --without-mail_smtp_module --without-mail_imap_module --without-mail_pop3_module --with-http_v2_module --with-ipv6 --with-stream --with-stream_ssl_module --with-stream_ssl_preread_module

The integrated OpenSSL version in Chef for nginx needs to be upgraded and it currently blocks everything.

Expected Result

Show just works.

Actual Result

When manually trying to connect via curl when the client is set to fips and using the newer openssl version.

curl -v -k https://myserver.test.com/health --tls-max 1.2
*   Trying 10.1.3.22:443...
* Connected to myserver.test.com (10.1.3.22) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
*  CAfile: /etc/pki/tls/certs/ca-bundle.crt
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS header, Unknown (21):
* TLSv1.2 (OUT), TLS alert, handshake failure (552):
* error:1C8000E9:Provider routines::ems not enabled
* Closing connection 0
curl: (35) error:1C8000E9:Provider routines::ems not enabled

Start with the reported /opt/opscode/embedded/sbin/nginx -V output and the RHEL 9 FIPS handshake failure showing that EMS is not enabled. Investigate how Chef Server 15.7.0 embeds OpenSSL for nginx; done means a FIPS-enabled RHEL 9 client can connect successfully to the Chef Server health endpoint.