Bug 1997516

Description of problem:
Launch a RHEL-8 on GCP, enable FIPS, and try to install packages from the default RHUI.
It always failed due to: Failed to download metadata for repo 'rhui-codeready-builder-for-rhel-8-x86_64-rhui-debug-rpms' as SSL certificate algorithm too weak
Details could be found at: https://mastern-jenkins-csb-openshift-qe.apps.ocp4.prod.psi.redhat.com/job/ocp4-rhel-scaleup-runner/13053/console


Red Hat Update Infrastructure for Cloud Providers
Security
High

How producible:
always

Version-Release number of selected component (if applicable):
Google-rhui-client-rhel8-2.1-1.noarch

Steps to reproduce:
Launch a RHEL-8 on GCP, enable FIPS, try to install packages from the default RHUI

Actual result:
Get available cri-o RPM versions failed, Rhel8 scaleup failed


TASK [openshift_node : Get available cri-o RPM versions] ***********************
Sunday 22 August 2021  14:53:50 +0800 (0:00:00.079)       0:00:05.587 ********* 
fatal: [10.0.128.6]: FAILED! => {"changed": false, "msg": "Failed to download metadata for repo 'rhui-codeready-builder-for-rhel-8-x86_64-rhui-debug-rpms': Cannot prepare internal mirrorlist: Curl error (60): Peer certificate cannot be authenticated with given CA certificates for https://cds.rhel.updates.googlecloud.com/pulp/mirror//content/dist/rhel8/rhui/8/x86_64/codeready-builder/debug [SSL certificate problem: CA signature digest algorithm too weak]", "rc": 1, "results": []}
fatal: [10.0.128.5]: FAILED! => {"changed": false, "msg": "Failed to download metadata for repo 'rhui-codeready-builder-for-rhel-8-x86_64-rhui-debug-rpms': Cannot prepare internal mirrorlist: Curl error (60): Peer certificate cannot be


Expected result:
Get available cri-o RPM versions succeeded without error. Rhel8 scaleup succeeded

Additional info: 
No such issue when fips is disabled.
Strong crypto defaults in RHEL 8 and deprecation of weak crypto algorithms: https://access.redhat.com/articles/3642912