Skip to Content
New release 11.7 available 🎉
LicensingFIPS Compliance

FIPS Compliance

Babel Licensing runs on FIPS-enabled Linux hosts, and its license validation does not rely on any algorithm that FIPS disallows. This page explains how the library behaves on such hosts, a startup issue you may encounter in containers, and how to resolve it.

Background

Many customers deploy on hosts where the operating system runs in FIPS mode — on Linux this is exposed as /proc/sys/crypto/fips_enabled = 1. In this mode the platform crypto provider (OpenSSL on Linux) is expected to service every cryptographic operation through a certified FIPS module.

A common problem arises when a container inherits the host’s FIPS flag but its base image does not ship a certified OpenSSL FIPS provider. OpenSSL 3 then tries to enter FIPS mode, fails to load the FIPS provider module, and ends up in a broken state where every digest and cipher operation fails — not only the ones FIPS would normally disallow. The typical error is:

Interop+Crypto+OpenSslCryptographicException:
    error:03000086:digital envelope routines::initialization error

This is an environment condition, not a defect in Babel Licensing. It is documented independently of Babel — see dotnet/dotnet-docker#5849  and dotnet/runtime#87884 . It affects any OpenSSL-backed .NET cryptography in the process, including TLS (HttpClient, gRPC), not just license validation.

How it can surface during license validation

Because the whole OpenSSL layer is unusable, the first cryptographic operation performed at startup is where the failure appears. When a license carries an expiration date, Babel Licensing opens a small local store used for expiry tracking and clock-rollback detection. On modern .NET the store initialization computes an identity hash through the platform provider, which throws on a broken-FIPS host. The failure is reported as:

Babel.Licensing.BabelLicenseException: Internal error
 ---> ...OpenSslCryptographicException: error:03000086:...

Hardening (upcoming 11.7.x patch). An upcoming Babel Licensing patch reworks the license store so that a broken platform crypto stack no longer breaks license validation: the store transparently falls back to a fully managed implementation, and license validation degrades gracefully instead of failing. On healthy hosts behavior is unchanged. Until you are on that build, apply the environment fix below.

Resolving it in containers

Make OpenSSL usable inside the container. Either option resolves the license-validation symptom and every other OpenSSL-backed operation in your process.

Option 1 — Do not auto-enter FIPS in the container

On Ubuntu-based .NET images, OpenSSL honors the OPENSSL_FORCE_FIPS_MODE environment variable. Set it to 0 so OpenSSL does not try to enter FIPS mode with a provider the image does not ship.

In docker-compose.yml, add it to the licensing service environment:

    environment:
      # Do not auto-enter FIPS mode using a provider the image doesn't ship
      OPENSSL_FORCE_FIPS_MODE: 0

or in a Dockerfile:

ENV OPENSSL_FORCE_FIPS_MODE=0

Use this when the container itself does not need to be FIPS-validated: the host stays FIPS-enabled and only this container’s OpenSSL opts out of the broken auto-FIPS path.

Option 2 — Use a base image with a certified FIPS provider

If FIPS compliance is required inside the container, run on a base image that ships a validated OpenSSL FIPS provider so OpenSSL initializes correctly instead of failing:

  • Red Hat UBI 9 based .NET images (registry.access.redhat.com/ubi9/dotnet-90 and similar), or
  • Ubuntu Pro with the FIPS-certified OpenSSL packages.

Verifying the environment

A quick check from inside the container tells you whether OpenSSL is healthy:

# Fails on a broken-FIPS host, succeeds once fixed
echo test | openssl dgst -sha1
  • Failure with error:03000086 (or a message about fips.so not being loadable) — OpenSSL is in the broken state; apply Option 1 or 2.
  • A normal SHA1(stdin)= ... line — OpenSSL is healthy and Babel Licensing runs normally.

Even with the upcoming license-validation hardening, we recommend fixing the OpenSSL environment anyway: without it, other OpenSSL-backed operations in your process (notably TLS to the Babel Licensing Service) will still fail.

Last updated on