Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
- Firefox throws SSL errors when FIPS is enabled
Version-Release number of selected component (if applicable):
- RHEL 8.0
How reproducible:
100%
Steps to Reproduce:
Reproducer steps
- boot RHEL 8 installation media
- at the prompt, press tab. Add 'fips=1' to the cmdline and hit enter
- during installation, go to security profiles and select the OSPP profile
- install as server with GUI
- boot in to newly installed OS and complete EULA
- log in as a non-root user and run firefox
- browse to www.google.com
- observe
Firefox will report the following error: (with URL redirect from www.google.com to https://www.google.com/?gws_rd=ssl)
8<-----8<-----8<-----8<-----8<-----8<-----8<-----8<-----8<-----8<-----8<----
Secure Connection Failed
An error occurred during a connection to www.google.com. security library failure. Error code:
SEC_ERROR_LIBRARY_FAILURE
- The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
- Please contact the website owners to inform them of this problem
Learn more...
8<-----8<-----8<-----8<-----8<-----8<-----8<-----8<-----8<-----8<-----8<----
As a test, I rebooted without fips enabled (changed fips=1 to fips=0 on the kernel cmdline), and FF works
Actual results:
- Firefox will throw above SSL error on certain websites, including www.google.com
Expected results:
- able to browse websites normally
Additional info:
it fails on RHEL-8.1.0-20190730.n.0 with
nspr-4.21.0-3.el8_0.x86_64.rpm
nss-sysinit-3.44.0-7.el8_0.x86_64.rpm
nss-softokn-3.44.0-7.el8_0.x86_64.rpm
nss-tools-3.44.0-7.el8_0.x86_64.rpm
nss-3.44.0-7.el8_0.x86_64.rpm
nss-softokn-freebl-3.44.0-7.el8_0.x86_64.rpm
nss-util-3.44.0-7.el8_0.x86_64.rpm
firefox-68.0.1-3.el8_0.x86_64.rpm
firefox-debuginfo-68.0.1-3.el8_0.x86_64.rpm
firefox-debugsource-68.0.1-3.el8_0.x86_64.rpm
(In reply to Martin Stransky from comment #3)
> Do I understand correctly that this bug was present in FF 60.8.0 and it's
> also there in FF68.0? Thanks.
yes
Martin, we already have bug 1724250 for tracking TLS 1.3 support in FIPS mode.
Unless we get some additional information to show that this issue is not TLS 1.3 related, I will close this bug as a duplicate.