Skip to content

nodejs18 and openssl 3.0.8 #4159

Closed as not planned
Closed as not planned
nodejs18 and openssl 3.0.8#4159
Labels
buildquestionstale

Description

@coltonfreeman26
coltonfreeman26
opened on May 11, 2023

Details

We are trying to build node 18 off of your docker image. we are using a custom alpine:3.17 base image that installs openssl 3.0.8 and enables fips. We are running into an issue with the variable NODE_EXTRA_CA_CERTS that returns the error

node[1]: ../src/node.cc:1040:std::unique_ptr<node::InitializationResult> node::InitializeOncePerProcess(const std::vector<std::__cxx11::basic_string<char> >&, node::ProcessFlags::Flags): Assertion `crypto::CSPRNG(nullptr, 0).is_ok()' failed.

I am having trouble finding any relevant information on the error nor that variable. My main question is "is node18 compatible with openssl 3.0.8? I see here that it is compatible and fips capable with openssl 3.0.0

One other question if you know would be where that variable would store the cert in the container? NODE_EXTRA_CA_CERTS

Node.js version

18.16.0

Example code

I can paste the dockerfiles if you would like.

docker run -e NODE_EXTRA_CA_CERTS=cert.pem nodejs18-slim:test1

[[AWarning: Ignoring extra certs from `cert.pem`, load failed: error:80000002:system library::No such file or directory

node[1]: ../src/node.cc:1040:std::unique_ptr<node::InitializationResult> node::InitializeOncePerProcess(const std::vector<std::__cxx11::basic_string<char> >&, node::ProcessFlags::Flags): Assertion `crypto::CSPRNG(nullptr, 0).is_ok()' failed.

Operating system

locally it is a mac intel 86x64x

Scope

Runtime error that i think might be cause by our base image. Not a developer so am unfamiliar with node. I have googled this extensively but am lost at this point. Our image works fine thus far except for then trying to pass in new certs.

Module and version

Not applicable.

Activity

  1. preveen-stack commented on May 13, 2023

    @preveen-stack
    preveen-stack
    on May 13, 2023
    Contributor

    https://github.com/nodejs/node/blob/c5f46293abe434b536f8caf24031692cba47e4f4/src/node.cc#L1039-L1040

     // Ensure CSPRNG is properly seeded.
    CHECK(crypto::CSPRNG(nullptr, 0).is_ok())

    Looks like CSPRNG init fails

    can you try

    docker run -e NODE_EXTRA_CA_CERTS=cert.pem -it --memodry 2g --cpus 2  nodejs18-slim:test1
  2. tniessen
    added
    question
    build
    on Jun 5, 2023

  3. tniessen commented on Jun 5, 2023

    @tniessen
    tniessen
    on Jun 5, 2023
    Member

    @coltonfreeman26 How do you enable FIPS? If you load the FIPS provider through a custom OpenSSL configuration file (or if you use a system OpenSSL configuration file that enables FIPS) you may need to explicitly enable a random-number generator implementation. CSPRNG() may fail if no random-number generator implementation has been enabled.

  4. richardlau commented on Jun 5, 2023

    @richardlau
    richardlau
    on Jun 5, 2023
    Member

    As NODE_EXTRA_CA_CERTS is involved, this might be related to nodejs/node#48143. nodejs/node#48159 hasn't gone out in a release yet -- in needs to be released in Node.js 20 first before we consider it for Node.js 18.

  5. coltonfreeman26 commented on Jun 5, 2023

    @coltonfreeman26
    coltonfreeman26
    on Jun 5, 2023
    Author

    @tniessen We are using the system openssl with alpine. fips is being inherited. i messed around with this a little bit and i seem to have success with this when i install node via apk. i am guessing this has something to do with how we are enabling fips on the host. i am not familiar with CSPRING but will need to dive into that more. i will also take a look into enabling a random number generator.

    @preveen-stack i most certainly can. i will let you know if there is any luck there.

    @richardlau thank you for those links. i will read through those and update if this looks like our issue.

    thank you all for the feedback.

  6. ckcr4lyf commented on Jun 7, 2023

    @ckcr4lyf
    ckcr4lyf
    on Jun 7, 2023

    if you know would be where that variable would store the cert in the container? NODE_EXTRA_CA_CERTS

    @coltonfreeman26 it should be the path to the certs in the container. If cert.pem is a local file on the host system, you would need to copy it into the Dockerfile, and then provide the path relative to the container.

    Host dir structure:

    $ ls
Dockerfile
my_extra_cert.pem

    Dockerfile needs to copy the cert into the container:

    FROM node:18

# Relative to the container, the cert will be in /my_extra_cert.pem!
COPY my_extra_cert.pem /my_extra_cert.pem 

# Other dockerfile stuff...

    Then run as:

    docker run -e NODE_EXTRA_CA_CERTS=/my_extra_cert.pem nodejs18-slim:test1

    NOTE THE VAR IS /my_extra_cert.pem! (Absolute path)

  7. ckcr4lyf commented on Jun 7, 2023

    @ckcr4lyf
    ckcr4lyf
    on Jun 7, 2023

    Btw, if you copy the cert into the container via the dockerfile, you can also specify the env variable in the dockerfile itself, e.g.:

    FROM node:18

# Relative to the container, the cert will be in /my_extra_cert.pem!
COPY my_extra_cert.pem /my_extra_cert.pem 

# Other dockerfile stuff

# Set the extra ca certs var
ENV NODE_EXTRA_CA_CERTS=/my_extra_cert.pem

  8. coltonfreeman26 commented on Jun 7, 2023

    @coltonfreeman26
    coltonfreeman26
    on Jun 7, 2023
    Author

    Hmm, I thought the point of that NODE_EXTRA_CA_CERTS was so someone could add a cert at runtime. We are not wanting to copy in any specific cert at this time. We need this functionality so downstream users can add self signed certs. Mounting seems to work for this but am trying to figure out why we are unable to get this to work.

  9. ckcr4lyf commented on Jun 7, 2023

    @ckcr4lyf
    ckcr4lyf
    on Jun 7, 2023

    Mounting seems to work

    Right, if you mount you local directory into the container that could also work. As long as node in the container has a path relative to it , which it can read (e.g. mount host into docker container)

  10. github-actions commented on May 3, 2024

    @github-actions
    github-actionsbot
    on May 3, 2024 – with GitHub Actions

    There has been no activity on this issue for 11 months. The help repository works best when sustained engagement moves conversation forward. The issue will be closed in 1 month. If you are still experiencing this issue on the latest supported versions of Node.js, please leave a comment.

  11. github-actions
    added
    stale
    on May 3, 2024

  12. github-actions commented on Jun 3, 2024

    @github-actions
    github-actionsbot
    on Jun 3, 2024 – with GitHub Actions

    It seems there has been no activity on this issue for a while, and it is being closed. If you believe this issue should remain open, please leave a comment.
    If you need further assistance or have questions, you can also search for similar issues on Stack Overflow.
    Make sure to look at the README file for the most updated links.

  13. github-actions
    closed this as not plannedon Jun 3, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    buildquestionstale

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions