Description of problem:

After upgrading to nss-3.53, the `pcs cluster auth` command fails when FIPS mode is enabled.

~~~
[root@fastvm-rhel-7-6-21 ~]# pcs cluster auth -u hacluster -p <pass> --debug
...
Finished running: /usr/bin/ruby -I/usr/lib/pcsd/ /usr/lib/pcsd/pcsd-cli.rb auth
Return value: 0
--Debug Stdout Start--
{
  "status": "ok",
  "data": {
    "auth_responses": {
      "node1": {
        "status": "noresponse"
      },
      "node2": {
        "status": "noresponse"
      }
    },
    "sync_successful": true,
    "sync_nodes_err": [

    ],
    "sync_responses": {
    }
  },
  "log": [
    "I, [2020-10-14T17:03:05.441986 #8259]  INFO -- : PCSD Debugging enabled\n",
    "D, [2020-10-14T17:03:05.444008 #8259] DEBUG -- : Did not detect RHEL 6\n",
    "D, [2020-10-14T17:03:05.444035 #8259] DEBUG -- : Detected systemd is in use\n",
    "I, [2020-10-14T17:03:05.501902 #8259]  INFO -- : Running: /usr/sbin/corosync-cmapctl totem.cluster_name\n",
    "I, [2020-10-14T17:03:05.501989 #8259]  INFO -- : CIB USER: hacluster, groups: \n",
    "D, [2020-10-14T17:03:05.504882 #8259] DEBUG -- : []\n",
    "D, [2020-10-14T17:03:05.504938 #8259] DEBUG -- : [\"Failed to initialize the cmap API. Error CS_ERR_LIBRARY\\n\"]\n",
    "D, [2020-10-14T17:03:05.504968 #8259] DEBUG -- : Duration: 0.002876974s\n",
    "I, [2020-10-14T17:03:05.505005 #8259]  INFO -- : Return Value: 1\n",
    "I, [2020-10-14T17:03:05.597564 #8259]  INFO -- : No response from: node1 request: auth, error: ssl_connect_error\n",
    "I, [2020-10-14T17:03:05.597682 #8259]  INFO -- : No response from: node2 request: auth, error: ssl_connect_error\n"
  ]
}

--Debug Stdout End--
~~~


Disabling FIPS mode or reverting to nss-3.44 causes the issue to disappear.

PCSD listens on port 2224/tcp by default. Below is a curl comparison of connection to the same endpoint with nss-3.53 (broken) and nss-3.44 (working):

~~~
# # With 3.53
[root@fastvm-rhel-7-6-21 ~]# curl -k -v https://node1:2224/auth
* About to connect() to node1 port 2224 (#0)
*   Trying 192.168.22.21...
* Connected to node1 (192.168.22.21) port 2224 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* skipping SSL peer certificate verification
* NSS error -8187 (SEC_ERROR_INVALID_ARGS)
* security library: invalid arguments.
* Closing connection 0
curl: (35) security library: invalid arguments.


# # With 3.44
[root@fastvm-rhel-7-6-21 ~]# curl -k -v https://node1:2224/auth
* About to connect() to node1 port 2224 (#0)
*   Trying 192.168.22.21...
* Connected to node1 (192.168.22.21) port 2224 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* skipping SSL peer certificate verification
* SSL connection using TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
* Server certificate:
* 	subject: CN=fastvm-rhel-7-6-21,OU=pcsd,O=pcsd,L=Minneapolis,ST=MN,C=US
* 	start date: Aug 28 05:26:27 2020 GMT
* 	expire date: Aug 26 05:26:27 2030 GMT
* 	common name: fastvm-rhel-7-6-21
* 	issuer: CN=fastvm-rhel-7-6-21,OU=pcsd,O=pcsd,L=Minneapolis,ST=MN,C=US
> GET /auth HTTP/1.1
> User-Agent: curl/7.29.0
> Host: node1:2224
> Accept: */*
> 
< HTTP/1.1 401 Unauthorized 
...
* Connection #0 to host node1 left intact
~~~


The /etc/pki/ directory and the /etc/sysconfig/pcsd file are unmodified.

It's not clear to me whether this is a problem in nss, or whether pcsd needs to be modified to handle more secure settings in nss-3.53 that disallow the current pcsd defaults. I would like the nss team's input on what is preventing the connection from succeeding, and then we can modify pcsd if needed.

I've CC'd pcs developer Tomas Jelinek.

-----

Version-Release number of selected component (if applicable):

nss-3.53.1-3.el7_9.x86_64
pcs-0.9.169-3.el7.x86_64

-----

How reproducible:

Always

-----

Steps to Reproduce:
1. Enable FIPS mode.
2. Install nss-3.53.1-3.el7_9.x86_64 and its associated nss-* packages.
3. Start the pcsd service.
4. Attempt to authenticate (`pcs cluster auth node1`) or to connect to the authentication endpoint (`curl -k https://node1:2224/auth`).

-----

Actual results:

`pcs cluster auth` fails with an ssl_connect_error from curl in the debug output.
`curl` fails with "NSS error -8187 (SEC_ERROR_INVALID_ARGS)".

-----

Expected results:

`pcs cluster auth` and `curl` succeed without errors or warnings.