FIPS Compliance

Babel Licensing runs on FIPS-enabled Linux hosts, and its license validation does not rely on any algorithm that FIPS disallows. This page explains how the library behaves on such hosts, a startup issue you may encounter in containers, and how to resolve it.

Background

Many customers deploy on hosts where the operating system runs in FIPS mode — on Linux this is exposed as /proc/sys/crypto/fips_enabled = 1. In this mode the platform crypto provider (OpenSSL on Linux) is expected to service every cryptographic operation through a certified FIPS module.

A common problem arises when a container inherits the host’s FIPS flag but its base image does not ship a certified OpenSSL FIPS provider. OpenSSL 3 then tries to enter FIPS mode, fails to load the FIPS provider module, and ends up in a broken state where every digest and cipher operation fails — not only the ones FIPS would normally disallow. The typical error is:

Interop+Crypto+OpenSslCryptographicException:
    error:03000086:digital envelope routines::initialization error

How it can surface during license validation

Because the whole OpenSSL layer is unusable, the first cryptographic operation performed at startup is where the failure appears. When a license carries an expiration date, Babel Licensing opens a small local store used for expiry tracking and clock-rollback detection. On modern .NET the store initialization computes an identity hash through the platform provider, which throws on a broken-FIPS host. The failure is reported as:

Babel.Licensing.BabelLicenseException: Internal error
 ---> ...OpenSslCryptographicException: error:03000086:...

Resolving it in containers

Make OpenSSL usable inside the container. Either option resolves the license-validation symptom and every other OpenSSL-backed operation in your process.

Option 1 — Do not auto-enter FIPS in the container

On Ubuntu-based .NET images, OpenSSL honors the OPENSSL_FORCE_FIPS_MODE environment variable. Set it to 0 so OpenSSL does not try to enter FIPS mode with a provider the image does not ship.

In docker-compose.yml, add it to the licensing service environment:

    environment:
      # Do not auto-enter FIPS mode using a provider the image doesn't ship
      OPENSSL_FORCE_FIPS_MODE: 0

or in a Dockerfile:

ENV OPENSSL_FORCE_FIPS_MODE=0

Use this when the container itself does not need to be FIPS-validated: the host stays FIPS-enabled and only this container’s OpenSSL opts out of the broken auto-FIPS path.

Option 2 — Use a base image with a certified FIPS provider

If FIPS compliance is required inside the container, run on a base image that ships a validated FIPS provider so the crypto layer initializes correctly instead of failing:

• Azure Linux 3.0 .NET images (mcr.microsoft.com/dotnet/aspnet:8.0-azurelinux3.0 and similar), which ship Microsoft’s FIPS-certified SymCrypt provider,
• Red Hat UBI 9 based .NET images (registry.access.redhat.com/ubi9/dotnet-90 and similar), or
• Ubuntu Pro with the FIPS-certified OpenSSL packages.

Babel Licensing Service on FIPS hosts

The Babel Licensing Service runs on FIPS-enabled hosts as long as the image actually ships a FIPS provider module. The full licensing workflow has been verified on Azure Linux 3.0, whose .NET images ship Microsoft’s FIPS-certified SymCrypt provider, with FIPS enforced:

• the service starts and validates its own license,
• license templates and RSA-signed licenses are created,
• clients activate and validate licenses over gRPC,
• node-locking, activation tokens, heartbeats and deactivation all work.

What happens when the FIPS module is missing

The distinction that matters is not “FIPS on or off”, but whether the provider module that FIPS mode requires is present.

OpenSSL 3 does not implement algorithms itself: it loads them from plug-in providers. In FIPS mode the configuration requires every algorithm to come from the certified FIPS provider (the fips.so module). If that module is not installed in the image — as is the case for the standard Debian/Ubuntu .NET images — OpenSSL cannot satisfy any request, so every algorithm fails, including the ones FIPS itself permits.

Since .NET on Linux delegates all cryptography to OpenSSL, this takes down more than hashing and ciphers:

Verifying the environment

A quick check from inside the container tells you whether OpenSSL is healthy:

# Fails on a broken-FIPS host, succeeds once fixed
echo test | openssl dgst -sha1

• Failure with error:03000086 (or a message about fips.so not being loadable) — OpenSSL is in the broken state; apply Option 1 or 2.
• A normal SHA1(stdin)= ... line — OpenSSL is healthy and Babel Licensing runs normally.