diff --git a/.github/workflows/test-shared.yml b/.github/workflows/test-shared.yml
index a8f2ddc27831..264fbe70ce7e 100644
--- a/.github/workflows/test-shared.yml
+++ b/.github/workflows/test-shared.yml
@@ -251,8 +251,9 @@ jobs:
# the matrix-selected nixpkgs attribute (e.g. `openssl_3_6`). All
# other shared libs (brotli, cares, libuv, …) keep their defaults.
# `permittedInsecurePackages` whitelists just the matrix-selected
- # release (e.g. `openssl-1.1.1w`) so EOL-with-extended-support
- # cycles evaluate without relaxing nixpkgs' meta check globally.
+ # releases so EOL-with-extended-support cycles evaluate without
+ # relaxing nixpkgs' meta check globally. It is empty while every
+ # matrix entry is a supported release.
extra-nix-flags: |
--arg useSeparateDerivationForV8 ${{ needs.build-aarch64-linux-v8.outputs.local-cache && '"$(nix-store --import < libv8-aarch64-linux.nar)"' || 'true' }} \
--arg sharedLibDeps "(import $TAR_DIR/tools/nix/sharedLibDeps.nix {}) // {
diff --git a/BUILDING.md b/BUILDING.md
index e477d46863f4..b1accbe8962a 100644
--- a/BUILDING.md
+++ b/BUILDING.md
@@ -206,7 +206,7 @@ on your Linux distribution.
#### OpenSSL asm support
-OpenSSL-1.1.1 requires the following assembler version for use of asm
+OpenSSL requires the following assembler version for use of asm
support on x86\_64 and ia32.
For use of AVX-512,
@@ -214,8 +214,6 @@ For use of AVX-512,
* gas (GNU assembler) version 2.26 or higher
* nasm version 2.11.8 or higher in Windows
-AVX-512 is disabled for Skylake-X by OpenSSL-1.1.1.
-
For use of AVX2,
* gas (GNU assembler) version 2.23 or higher
@@ -223,7 +221,7 @@ For use of AVX2,
* llvm version 3.3 or higher
* nasm version 2.10 or higher in Windows
-Please refer to for details.
+Please refer to for details.
If compiling without one of the above, use `configure` with the
`--openssl-no-asm` flag. Otherwise, `configure` will fail.
@@ -1044,14 +1042,20 @@ using the following configure option:
## Building Node.js with FIPS-compliant OpenSSL
-Node.js supports FIPS when statically or dynamically linked with OpenSSL 3 via
-[OpenSSL's provider model](https://docs.openssl.org/3.0/man7/crypto/#OPENSSL-PROVIDERS).
-It is not necessary to rebuild Node.js to enable support for FIPS.
+Node.js can use an OpenSSL FIPS provider via
+[OpenSSL's provider model](https://docs.openssl.org/master/man7/crypto/#openssl-providers),
+whether OpenSSL is linked statically or dynamically. It is not necessary to
+rebuild Node.js to do so; the provider and the OpenSSL configuration that
+activates it are supplied at runtime.
+
+Node.js does not build a FIPS provider. OpenSSL requires that a FIPS provider
+be built from a release that carries a FIPS certificate, so a provider built
+as part of the Node.js build would have no validation status.
-When using OpenSSL 1.1.1, Node.js must be built against a FIPS-capable OpenSSL.
+`./configure --openssl-is-fips` only records that the OpenSSL being linked is
+FIPS capable, and requires `--shared-openssl`.
-See [FIPS mode](doc/api/crypto.md#fips-mode) for more information on how to
-enable FIPS support in Node.js.
+See [FIPS mode](doc/api/crypto.md#fips-mode) for how to configure it.
## Building Node.js with Temporal support
@@ -1135,6 +1139,10 @@ A number of `configure` options are provided to support this use case.
provide the ability to set the path to an external JavaScript file
for the dependency to be used at runtime.
+When building with `--shared-openssl`, Node.js requires OpenSSL 3.0 or later.
+Support for building against OpenSSL 1.x was removed in Node.js 27.0.0, and
+`configure` fails if an older version is detected.
+
It is the responsibility of any distribution
shipping with these options to:
diff --git a/configure.py b/configure.py
index 27dafbe0687d..28e7264c5834 100755
--- a/configure.py
+++ b/configure.py
@@ -268,7 +268,8 @@
action='store_true',
dest='openssl_is_fips',
default=None,
- help='specifies that the OpenSSL library is FIPS compatible')
+ help='specifies that the shared OpenSSL library is FIPS capable '
+ '(requires --shared-openssl)')
parser.add_argument('--openssl-use-def-ca-store',
action='store_true',
@@ -2275,7 +2276,6 @@ def configure_openssl(o):
variables['node_shared_ngtcp2'] = b(options.shared_ngtcp2)
variables['node_shared_nghttp3'] = b(options.shared_nghttp3)
variables['openssl_is_fips'] = b(options.openssl_is_fips)
- variables['node_fipsinstall'] = b(False)
if options.openssl_no_asm:
variables['openssl_no_asm'] = 1
@@ -2330,17 +2330,25 @@ def without_ssl_error(option):
if options.openssl_no_asm and options.shared_openssl:
error('--openssl-no-asm is incompatible with --shared-openssl')
+ if options.openssl_is_fips and not options.shared_openssl:
+ error('--openssl-is-fips is only available with --shared-openssl')
+
if options.openssl_is_fips:
o['defines'] += ['OPENSSL_FIPS']
- if options.openssl_is_fips and not options.shared_openssl:
- variables['node_fipsinstall'] = b(True)
-
configure_library('openssl', o)
o['variables']['openssl_version'] = get_openssl_version(o)
o['variables']['openssl_is_boringssl'] = get_openssl_is_boringssl(o)
+ # BoringSSL identifies itself as OpenSSL 1.1.1 and is exempt from this check.
+ # A version of 0 means detection failed, which is already warned about in
+ # get_openssl_version() and is caught at compile time by ncrypto.h.
+ openssl_version = o['variables']['openssl_version']
+ if o['variables']['openssl_is_boringssl'] == 'false' and \
+ 0 < openssl_version < 0x30000000:
+ error('OpenSSL 1.x is no longer supported, v3.0.0 or later is required.')
+
def configure_lief(o):
if options.without_lief:
if options.shared_lief:
diff --git a/deps/ncrypto/engine.cc b/deps/ncrypto/engine.cc
index a8e64e250491..6b9514b8565e 100644
--- a/deps/ncrypto/engine.cc
+++ b/deps/ncrypto/engine.cc
@@ -1,8 +1,7 @@
#include "ncrypto.h"
-#if !defined(OPENSSL_NO_ENGINE) && \
- ((defined(NCRYPTO_ENGINE_COMPAT) && NCRYPTO_ENGINE_COMPAT) || \
- NCRYPTO_USE_LEGACY_OPENSSL)
+#if !defined(OPENSSL_NO_ENGINE) && defined(NCRYPTO_ENGINE_COMPAT) && \
+ NCRYPTO_ENGINE_COMPAT
#include
#endif
diff --git a/deps/ncrypto/ncrypto.cc b/deps/ncrypto/ncrypto.cc
index b4fa65daa78c..480f5d7b3dc8 100644
--- a/deps/ncrypto/ncrypto.cc
+++ b/deps/ncrypto/ncrypto.cc
@@ -17,7 +17,7 @@
#include
#include
#include
-#if OPENSSL_VERSION_MAJOR >= 3
+#ifndef OPENSSL_IS_BORINGSSL
#include
#include
#include
@@ -61,17 +61,6 @@ constexpr static PQCMapping pqc_mappings[] = {
#endif
-// EVP_PKEY_CTX_set_dsa_paramgen_q_bits was added in OpenSSL 1.1.1e.
-#if OPENSSL_VERSION_NUMBER < 0x1010105fL
-#define EVP_PKEY_CTX_set_dsa_paramgen_q_bits(ctx, qbits) \
- EVP_PKEY_CTX_ctrl((ctx), \
- EVP_PKEY_DSA, \
- EVP_PKEY_OP_PARAMGEN, \
- EVP_PKEY_CTRL_DSA_PARAMGEN_Q_BITS, \
- (qbits), \
- nullptr)
-#endif
-
namespace ncrypto {
namespace {
using BignumCtxPointer = DeleteFnPtr;
@@ -528,7 +517,7 @@ DataPointer DataPointer::resize(size_t len) {
// ============================================================================
bool isFipsEnabled() {
ClearErrorOnReturn clear_error_on_return;
-#if OPENSSL_VERSION_MAJOR >= 3
+#ifndef OPENSSL_IS_BORINGSSL
return EVP_default_properties_is_fips_enabled(nullptr) == 1;
#else
return FIPS_mode() == 1;
@@ -538,7 +527,7 @@ bool isFipsEnabled() {
bool setFipsEnabled(bool enable, CryptoErrorList* errors) {
if (isFipsEnabled() == enable) return true;
ClearErrorOnReturn clearErrorOnReturn(errors);
-#if OPENSSL_VERSION_MAJOR >= 3
+#ifndef OPENSSL_IS_BORINGSSL
return EVP_default_properties_enable_fips(nullptr, enable ? 1 : 0) == 1;
#else
return FIPS_mode_set(enable ? 1 : 0) == 1;
@@ -547,7 +536,7 @@ bool setFipsEnabled(bool enable, CryptoErrorList* errors) {
bool testFipsEnabled() {
ClearErrorOnReturn clear_error_on_return;
-#if OPENSSL_VERSION_MAJOR >= 3
+#ifndef OPENSSL_IS_BORINGSSL
OSSL_PROVIDER* fips_provider = nullptr;
if (OSSL_PROVIDER_available(nullptr, "fips")) {
fips_provider = OSSL_PROVIDER_load(nullptr, "fips");
@@ -814,7 +803,7 @@ bool CSPRNG(void* buffer, size_t length) {
auto buf = reinterpret_cast(buffer);
do {
if (1 == RAND_status()) {
-#if OPENSSL_VERSION_MAJOR >= 3
+#ifndef OPENSSL_IS_BORINGSSL
if (1 == RAND_bytes_ex(nullptr, buf, length, 0)) {
return true;
}
@@ -827,7 +816,7 @@ bool CSPRNG(void* buffer, size_t length) {
return true;
#endif
}
-#if OPENSSL_VERSION_MAJOR >= 3
+#ifndef OPENSSL_IS_BORINGSSL
const auto code = ERR_peek_last_error();
// A misconfigured OpenSSL 3 installation may report 1 from RAND_poll()
// and RAND_status() but fail in RAND_bytes() if it cannot look up
@@ -1150,7 +1139,7 @@ bool PrintGeneralName(const BIOPointer& out, const GENERAL_NAME* gen) {
BIO_printf(out.get(), (j == 0) ? "%X" : ":%X", pair);
}
} else {
-#if OPENSSL_VERSION_MAJOR >= 3
+#ifndef OPENSSL_IS_BORINGSSL
BIO_printf(out.get(), "", ip_len);
#else
BIO_printf(out.get(), "");
@@ -1169,9 +1158,9 @@ bool PrintGeneralName(const BIOPointer& out, const GENERAL_NAME* gen) {
// awkward, especially when passed to translatePeerCertificate.
bool unicode = true;
const char* prefix = nullptr;
- // OpenSSL 1.1.1 does not support othername in GENERAL_NAME_print and may
+ // BoringSSL does not support othername in GENERAL_NAME_print and may
// not define these NIDs.
-#if OPENSSL_VERSION_MAJOR >= 3
+#ifndef OPENSSL_IS_BORINGSSL
int nid = OBJ_obj2nid(gen->d.otherName->type_id);
switch (nid) {
case NID_id_on_SmtpUTF8Mailbox:
@@ -1191,7 +1180,7 @@ bool PrintGeneralName(const BIOPointer& out, const GENERAL_NAME* gen) {
prefix = "NAIRealm";
break;
}
-#endif // OPENSSL_VERSION_MAJOR >= 3
+#endif // !OPENSSL_IS_BORINGSSL
int val_type = gen->d.otherName->value->type;
if (prefix == nullptr || (unicode && val_type != V_ASN1_UTF8STRING) ||
(!unicode && val_type != V_ASN1_IA5STRING)) {
@@ -1282,7 +1271,7 @@ bool SafeX509InfoAccessPrint(const BIOPointer& out, const X509_EXTENSION* ext) {
}
sk_ACCESS_DESCRIPTION_pop_free(descs, ACCESS_DESCRIPTION_free);
-#if OPENSSL_VERSION_MAJOR < 3
+#ifdef OPENSSL_IS_BORINGSSL
BIO_write(out.get(), "\n", 1);
#endif
@@ -3811,12 +3800,8 @@ Result EVPKeyPointer::writePrivateKey(
cipher,
passphrase);
}
-#else
-#if OPENSSL_VERSION_MAJOR >= 3
- const RSA* rsa = EVP_PKEY_get0_RSA(get());
#else
RSA* rsa = EVP_PKEY_get0_RSA(get());
-#endif
if (rsa == nullptr) return Result(false);
switch (config.format) {
@@ -3888,12 +3873,8 @@ Result EVPKeyPointer::writePrivateKey(
"type-specific",
cipher,
passphrase);
-#else
-#if OPENSSL_VERSION_MAJOR >= 3
- const EC_KEY* ec = EVP_PKEY_get0_EC_KEY(get());
#else
EC_KEY* ec = EVP_PKEY_get0_EC_KEY(get());
-#endif
if (ec == nullptr) return Result(false);
switch (config.format) {
@@ -3956,12 +3937,8 @@ Result EVPKeyPointer::writePublicKey(
mark_pop_error_on_return.peekError());
}
return bio;
-#else
-#if OPENSSL_VERSION_MAJOR >= 3
- const RSA* rsa = EVP_PKEY_get0_RSA(get());
#else
RSA* rsa = EVP_PKEY_get0_RSA(get());
-#endif
if (rsa == nullptr) return Result(false);
if (config.format == ncrypto::EVPKeyPointer::PKFormatType::PEM) {
@@ -4125,14 +4102,7 @@ EVPKeyPointer::operator Rsa() const {
#if NCRYPTO_USE_OPENSSL3_PROVIDER
return Rsa(get());
#else
- // TODO(tniessen): Remove the "else" branch once we drop support for OpenSSL
- // versions older than 1.1.1e via FIPS / dynamic linking.
- OSSL3_CONST RSA* rsa;
- if (OPENSSL_VERSION_NUMBER >= 0x1010105fL) {
- rsa = EVP_PKEY_get0_RSA(get());
- } else {
- rsa = static_cast(EVP_PKEY_get0(get()));
- }
+ OSSL3_CONST RSA* rsa = EVP_PKEY_get0_RSA(get());
if (rsa == nullptr) return {};
return Rsa(rsa);
#endif
@@ -4153,7 +4123,7 @@ EVPKeyPointer::operator Dsa() const {
bool EVPKeyPointer::validateDsaParameters() const {
if (!pkey_) return false;
-#if OPENSSL_VERSION_MAJOR >= 3
+#ifndef OPENSSL_IS_BORINGSSL
if (EVP_default_properties_is_fips_enabled(nullptr) && EVP_PKEY_DSA == id()) {
#else
if (FIPS_mode() && EVP_PKEY_DSA == id()) {
@@ -5571,11 +5541,7 @@ EVPKeyPointer EVPKeyCtxPointer::paramgen() const {
bool EVPKeyCtxPointer::publicCheck() const {
if (!ctx_) return false;
#ifndef OPENSSL_IS_BORINGSSL
-#if OPENSSL_VERSION_MAJOR >= 3
return EVP_PKEY_public_check_quick(ctx_.get()) == 1;
-#else
- return EVP_PKEY_public_check(ctx_.get()) == 1;
-#endif
#else // OPENSSL_IS_BORINGSSL
// Boringssl appears not to support this operation.
// TODO(jasnell): Is there an alternative approach that Boringssl does
@@ -6174,7 +6140,7 @@ struct CipherCallbackContext {
void operator()(const char* name) { cb(name); }
};
-#if OPENSSL_VERSION_MAJOR >= 3
+#ifndef OPENSSL_IS_BORINGSSL
template = 3
+#ifndef OPENSSL_IS_BORINGSSL
array_push_back= 0x3000000f', {
- 'defines!': [ '<@(ncrypto_legacy_openssl_defines)' ],
+ ['openssl_is_boringssl=="false"', {
'defines': [ '<@(ncrypto_strict_defines)' ],
}],
],
},
'sources': [ '<@(ncrypto_sources)' ],
'conditions': [
- ['openssl_is_boringssl=="false" and openssl_version >= 0x3000000f', {
- 'defines!': [ '<@(ncrypto_legacy_openssl_defines)' ],
+ ['openssl_is_boringssl=="false"', {
'defines': [ '<@(ncrypto_strict_defines)' ],
'dependencies': [
'ncrypto_engine',
],
}],
- ['openssl_is_boringssl=="false" and openssl_version < 0x3000000f', {
- 'sources': [ '<@(ncrypto_engine_sources)' ],
- }],
['node_shared_openssl=="false"', {
'dependencies': [
'../openssl/openssl.gyp:openssl'
@@ -63,7 +55,7 @@
},
],
'conditions': [
- ['openssl_is_boringssl=="false" and openssl_version >= 0x3000000f', {
+ ['openssl_is_boringssl=="false"', {
'targets': [
{
'target_name': 'ncrypto_engine',
diff --git a/deps/ncrypto/ncrypto.h b/deps/ncrypto/ncrypto.h
index 53302394f38b..0c050c9a3f76 100644
--- a/deps/ncrypto/ncrypto.h
+++ b/deps/ncrypto/ncrypto.h
@@ -29,6 +29,11 @@
(OPENSSL_VERSION_NUMBER >= (((maj) << 28) | ((min) << 20)))
#endif
+// BoringSSL reports itself as OpenSSL 1.1.1, so it has to be excluded here.
+#if !defined(OPENSSL_IS_BORINGSSL) && !OPENSSL_VERSION_PREREQ(3, 0)
+#error "OpenSSL 1.x is no longer supported, v3.0.0 or later is required."
+#endif
+
// BoringSSL declares the EVP_*_do_all* APIs, but their implementation may
// live in libdecrepit. This matches standalone ncrypto's build flag.
#ifndef NCRYPTO_BSSL_LIBDECREPIT_MISSING
@@ -43,31 +48,17 @@
// Backend split:
// - OpenSSL >= 3 uses provider APIs and hides deprecated low-level objects.
-// - BoringSSL has its own API-compatible branch.
-// - OpenSSL < 3 remains the legacy fallback branch.
-#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 0)
-#define NCRYPTO_USE_OPENSSL3_PROVIDER 1
-#else
-#define NCRYPTO_USE_OPENSSL3_PROVIDER 0
-#endif
-
+// - BoringSSL has its own API-compatible branch and keeps using the legacy
+// low-level key types.
#ifdef OPENSSL_IS_BORINGSSL
#define NCRYPTO_USE_BORINGSSL 1
+#define NCRYPTO_USE_OPENSSL3_PROVIDER 0
#else
#define NCRYPTO_USE_BORINGSSL 0
+#define NCRYPTO_USE_OPENSSL3_PROVIDER 1
#endif
-#if !NCRYPTO_USE_OPENSSL3_PROVIDER && !NCRYPTO_USE_BORINGSSL
-#define NCRYPTO_USE_LEGACY_OPENSSL 1
-#else
-#define NCRYPTO_USE_LEGACY_OPENSSL 0
-#endif
-
-#if NCRYPTO_USE_BORINGSSL || NCRYPTO_USE_LEGACY_OPENSSL
-#define NCRYPTO_USE_LEGACY_KEY_TYPES 1
-#else
-#define NCRYPTO_USE_LEGACY_KEY_TYPES 0
-#endif
+#define NCRYPTO_USE_LEGACY_KEY_TYPES NCRYPTO_USE_BORINGSSL
#if NCRYPTO_USE_OPENSSL3_PROVIDER
#include
@@ -75,13 +66,7 @@
#include
#endif
-// The FIPS-related functions are only available
-// when the OpenSSL itself was compiled with FIPS support.
-#if defined(OPENSSL_FIPS) && !OPENSSL_VERSION_PREREQ(3, 0)
-#include
-#endif // OPENSSL_FIPS
-
-#if OPENSSL_VERSION_PREREQ(3, 0)
+#if !defined(OPENSSL_IS_BORINGSSL)
#define OPENSSL_WITH_AES_OCB 1
#else
#define OPENSSL_WITH_AES_OCB 0
@@ -93,13 +78,9 @@
#define OPENSSL_WITH_ARGON2 0
#endif
-#if OPENSSL_VERSION_PREREQ(3, 0) || defined(OPENSSL_IS_BORINGSSL)
#define OPENSSL_WITH_KEM 1
-#else
-#define OPENSSL_WITH_KEM 0
-#endif
-#if OPENSSL_VERSION_PREREQ(3, 0)
+#if !defined(OPENSSL_IS_BORINGSSL)
#define OPENSSL_WITH_EVP_MAC 1
#else
#define OPENSSL_WITH_EVP_MAC 0
@@ -152,7 +133,7 @@
#define EVP_PKEY_ML_KEM_1024 NID_ML_KEM_1024
#endif
-#if OPENSSL_VERSION_PREREQ(3, 0)
+#if !defined(OPENSSL_IS_BORINGSSL)
#define OSSL3_CONST const
#else
#define OSSL3_CONST
diff --git a/deps/openssl/openssl.gyp b/deps/openssl/openssl.gyp
index 4e16412a0283..61234b5c6c4d 100644
--- a/deps/openssl/openssl.gyp
+++ b/deps/openssl/openssl.gyp
@@ -97,35 +97,6 @@
},
}],
]
- }, {
- # openssl-fipsmodule target
- 'target_name': 'openssl-fipsmodule',
- 'type': 'shared_library',
- 'dependencies': ['openssl-cli'],
- 'includes': ['./openssl_common.gypi'],
- 'include_dirs+': ['openssl/apps/include'],
- 'cflags': [ '-fPIC' ],
- #'ldflags': [ '-o', 'fips.so' ],
- #'ldflags': [ '-Wl,--version-script=providers/fips.ld',],
- 'conditions': [
- [ 'openssl_no_asm==1', {
- 'includes': ['./openssl-fips_no_asm.gypi'],
- }, 'target_arch=="arm64" and OS=="win"', {
- # VC-WIN64-ARM inherits from VC-noCE-common that has no asms.
- 'includes': ['./openssl-fips_no_asm.gypi'],
- }, 'gas_version and v(gas_version) >= v("2.26") or '
- 'nasm_version and v(nasm_version) >= v("2.11.8")', {
- # Require AVX512IFMA supported. See
- # https://www.openssl.org/docs/man1.1.1/man3/OPENSSL_ia32cap.html
- # Currently crypto/poly1305/asm/poly1305-x86_64.pl requires AVX512IFMA.
- 'includes': ['./openssl-fips_asm.gypi'],
- }, {
- 'includes': ['./openssl-fips_asm_avx2.gypi'],
- }],
- ],
- 'direct_dependent_settings': {
- 'include_dirs': [ 'openssl/include', 'openssl/crypto/include']
- }
- },
+ },
]
}
diff --git a/doc/api/crypto.md b/doc/api/crypto.md
index dcef80701f1d..cc3855dd1520 100644
--- a/doc/api/crypto.md
+++ b/doc/api/crypto.md
@@ -4243,7 +4243,7 @@ Key decapsulation using a KEM algorithm with a private key.
Supported key types and their KEM algorithms are:
-* `'rsa'`[^openssl30] RSA Secret Value Encapsulation
+* `'rsa'`[^noboringssl] RSA Secret Value Encapsulation
* `'ec'`[^openssl32] DHKEM(P-256, HKDF-SHA256), DHKEM(P-384, HKDF-SHA256), DHKEM(P-521, HKDF-SHA256)
* `'x25519'`[^openssl32] DHKEM(X25519, HKDF-SHA256)
* `'x448'`[^openssl32] DHKEM(X448, HKDF-SHA512)
@@ -4315,7 +4315,7 @@ Key encapsulation using a KEM algorithm with a public key.
Supported key types and their KEM algorithms are:
-* `'rsa'`[^openssl30] RSA Secret Value Encapsulation
+* `'rsa'`[^noboringssl] RSA Secret Value Encapsulation
* `'ec'`[^openssl32] DHKEM(P-256, HKDF-SHA256), DHKEM(P-384, HKDF-SHA256), DHKEM(P-521, HKDF-SHA256)
* `'x25519'`[^openssl32] DHKEM(X25519, HKDF-SHA256)
* `'x448'`[^openssl32] DHKEM(X448, HKDF-SHA512)
@@ -4328,18 +4328,6 @@ passed to [`crypto.createPublicKey()`][].
If the `callback` function is provided this function uses libuv's threadpool.
-### `crypto.fips`
-
-
-
-> Stability: 0 - Deprecated
-
-Deprecated property for checking and controlling [FIPS mode][]. Use
-[`crypto.getFips()`][] and [`crypto.setFips()`][] instead.
-
### `crypto.generateKey(type, options, callback)`
-Type: Runtime
+Type: End-of-Life
-The [`crypto.fips`][] property is deprecated. Please use `crypto.setFips()`
+The `crypto.fips` property is no longer supported. Use `crypto.setFips()`
and `crypto.getFips()` instead.
An automated migration is available ([source](https://github.com/nodejs/userland-migrations/tree/main/recipes/crypto-fips-to-getFips)).
@@ -4759,7 +4762,6 @@ calling or overriding `_listen2`.
[`crypto.createDecipheriv()`]: crypto.md#cryptocreatedecipherivalgorithm-key-iv-options
[`crypto.createHash()`]: crypto.md#cryptocreatehashalgorithm-options
[`crypto.createHmac()`]: crypto.md#cryptocreatehmacalgorithm-key-options
-[`crypto.fips`]: crypto.md#cryptofips
[`crypto.pbkdf2()`]: crypto.md#cryptopbkdf2password-salt-iterations-keylen-digest-callback
[`crypto.randomBytes()`]: crypto.md#cryptorandombytessize-callback
[`crypto.scrypt()`]: crypto.md#cryptoscryptpassword-salt-keylen-options-callback
diff --git a/doc/api/tls.md b/doc/api/tls.md
index f98bb2976721..dac38aef5e9d 100644
--- a/doc/api/tls.md
+++ b/doc/api/tls.md
@@ -182,8 +182,8 @@ On the client connection, a custom `checkServerIdentity` should be passed
because the default one will fail in the absence of a certificate.
According to the [RFC 4279][], PSK identities up to 128 bytes in length and
-PSKs up to 64 bytes in length must be supported. As of OpenSSL 1.1.0
-maximum identity size is 128 bytes, and maximum PSK length is 256 bytes.
+PSKs up to 64 bytes in length must be supported. In OpenSSL the maximum
+identity size is 128 bytes, and the maximum PSK length is 256 bytes.
The current implementation doesn't support asynchronous PSK callbacks due to the
limitations of the underlying OpenSSL API.
@@ -1207,7 +1207,7 @@ For example, a TLSv1.2 protocol with AES256-SHA cipher:
```
See
-[SSL\_CIPHER\_get\_name](https://www.openssl.org/docs/man1.1.1/man3/SSL_CIPHER_get_name.html)
+[SSL\_CIPHER\_get\_name](https://www.openssl.org/docs/man3.0/man3/SSL_CIPHER_get_name.html)
for more information.
### `tlsSocket.getEphemeralKeyInfo()`
@@ -1459,7 +1459,7 @@ added: v12.11.0
the client in the order of decreasing preference.
See
-[SSL\_get\_shared\_sigalgs](https://www.openssl.org/docs/man1.1.1/man3/SSL_get_shared_sigalgs.html)
+[SSL\_get\_shared\_sigalgs](https://www.openssl.org/docs/man3.0/man3/SSL_get_shared_sigalgs.html)
for more information.
### `tlsSocket.getTLSTicket()`
@@ -2048,7 +2048,7 @@ changes:
The list can contain digest algorithms (`SHA256`, `MD5` etc.), public key
algorithms (`RSA-PSS`, `ECDSA` etc.), combination of both (e.g
'RSA+SHA384') or TLS v1.3 scheme names (e.g. `rsa_pss_pss_sha512`).
- See [OpenSSL man pages](https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set1_sigalgs_list.html)
+ See [OpenSSL man pages](https://www.openssl.org/docs/man3.0/man3/SSL_CTX_set1_sigalgs_list.html)
for more info.
* `ciphers` {string} Cipher suite specification, replacing the default. For
more information, see [Modifying the default TLS cipher suite][]. Permitted
@@ -2555,7 +2555,7 @@ added: v0.11.3
[RFC 5077]: https://tools.ietf.org/html/rfc5077
[RFC 5929]: https://tools.ietf.org/html/rfc5929
[RFC 8879]: https://tools.ietf.org/html/rfc8879
-[SSL_METHODS]: https://www.openssl.org/docs/man1.1.1/man7/ssl.html#Dealing-with-Protocol-Methods
+[SSL_METHODS]: https://www.openssl.org/docs/man3.0/man7/ssl.html#Dealing-with-Protocol-Methods
[Session Resumption]: #session-resumption
[Stream]: stream.md#stream
[TLS recommendations]: https://wiki.mozilla.org/Security/Server_Side_TLS
@@ -2572,8 +2572,8 @@ added: v0.11.3
[`Duplex`]: stream.md#class-streamduplex
[`NODE_EXTRA_CA_CERTS`]: cli.md#node_extra_ca_certsfile
[`NODE_OPTIONS`]: cli.md#node_optionsoptions
-[`SSL_export_keying_material`]: https://www.openssl.org/docs/man1.1.1/man3/SSL_export_keying_material.html
-[`SSL_get_version`]: https://www.openssl.org/docs/man1.1.1/man3/SSL_get_version.html
+[`SSL_export_keying_material`]: https://www.openssl.org/docs/man3.0/man3/SSL_export_keying_material.html
+[`SSL_get_version`]: https://www.openssl.org/docs/man3.0/man3/SSL_get_version.html
[`crypto.getCurves()`]: crypto.md#cryptogetcurves
[`import()`]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/import
[`net.Server.address()`]: net.md#serveraddress
@@ -2608,6 +2608,6 @@ added: v0.11.3
[`x509.checkHost()`]: crypto.md#x509checkhostname-options
[asn1.js]: https://www.npmjs.com/package/asn1.js
[certificate object]: #certificate-object
-[cipher list format]: https://www.openssl.org/docs/man1.1.1/man1/ciphers.html#CIPHER-LIST-FORMAT
+[cipher list format]: https://www.openssl.org/docs/man3.0/man1/ciphers.html#CIPHER-LIST-FORMAT
[forward secrecy]: https://en.wikipedia.org/wiki/Perfect_forward_secrecy
[perfect forward secrecy]: #perfect-forward-secrecy
diff --git a/doc/api/webcrypto.md b/doc/api/webcrypto.md
index 562bdb37c2af..9e2918a26da4 100644
--- a/doc/api/webcrypto.md
+++ b/doc/api/webcrypto.md
@@ -119,15 +119,15 @@ WICG proposal:
Algorithms:
-* `'AES-OCB'`[^openssl30]
+* `'AES-OCB'`[^noboringssl]
* `'Argon2d'`[^openssl32]
* `'Argon2i'`[^openssl32]
* `'Argon2id'`[^openssl32]
* `'ChaCha20-Poly1305'`
* `'cSHAKE128'`
* `'cSHAKE256'`
-* `'KMAC128'`[^openssl30]
-* `'KMAC256'`[^openssl30]
+* `'KMAC128'`[^noboringssl]
+* `'KMAC256'`[^noboringssl]
* `'KT128'`
* `'KT256'`
* `'ML-DSA-44'`[^openssl35]
@@ -2719,7 +2719,7 @@ added:
[^modern-algos]: See [Modern Algorithms in the Web Cryptography API][]
-[^openssl30]: Requires OpenSSL >= 3.0
+[^noboringssl]: Not available when Node.js is built against BoringSSL
[^openssl32]: Requires OpenSSL >= 3.2
diff --git a/lib/crypto.js b/lib/crypto.js
index ac4b0a33efb8..ef2dfc9734a2 100644
--- a/lib/crypto.js
+++ b/lib/crypto.js
@@ -340,13 +340,6 @@ function getRandomBytesAlias(key) {
}
ObjectDefineProperties(module.exports, {
- fips: {
- __proto__: null,
- get: deprecate(getFips, 'The crypto.fips is deprecated. ' +
- 'Please use crypto.getFips()', 'DEP0093'),
- set: deprecate(setFips, 'The crypto.fips is deprecated. ' +
- 'Please use crypto.setFips()', 'DEP0093'),
- },
constants: {
__proto__: null,
configurable: false,
diff --git a/node.gyp b/node.gyp
index 7bff8e8a4e7f..4280ecf22fdd 100644
--- a/node.gyp
+++ b/node.gyp
@@ -788,87 +788,22 @@
]
}],
- ['node_fipsinstall=="true"', {
- 'variables': {
- 'openssl-cli': '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)openssl-cli<(EXECUTABLE_SUFFIX)',
- 'provider_name': 'libopenssl-fipsmodule',
- 'opensslconfig': './deps/openssl/nodejs-openssl.cnf',
- 'conditions': [
- ['GENERATOR == "ninja"', {
- 'fipsmodule_internal': '<(PRODUCT_DIR)/lib/<(provider_name).so',
- 'fipsmodule': '<(PRODUCT_DIR)/obj/lib/openssl-modules/fips.so',
- 'fipsconfig': '<(PRODUCT_DIR)/obj/lib/fipsmodule.cnf',
- 'opensslconfig_internal': '<(PRODUCT_DIR)/obj/lib/openssl.cnf',
- }, {
- 'fipsmodule_internal': '<(PRODUCT_DIR)/obj.target/deps/openssl/<(provider_name).so',
- 'fipsmodule': '<(PRODUCT_DIR)/obj.target/deps/openssl/lib/openssl-modules/fips.so',
- 'fipsconfig': '<(PRODUCT_DIR)/obj.target/deps/openssl/fipsmodule.cnf',
- 'opensslconfig_internal': '<(PRODUCT_DIR)/obj.target/deps/openssl/openssl.cnf',
- }],
- ],
- },
- 'actions': [
- {
- 'action_name': 'fipsinstall',
- 'process_outputs_as_sources': 1,
- 'inputs': [
- '<(fipsmodule_internal)',
- ],
- 'outputs': [
- '<(fipsconfig)',
- ],
- 'action': [
- '<(openssl-cli)', 'fipsinstall',
- '-provider_name', '<(provider_name)',
- '-module', '<(fipsmodule_internal)',
- '-out', '<(fipsconfig)',
- #'-quiet',
- ],
- },
- {
- 'action_name': 'copy_fips_module',
- 'inputs': [
- '<(fipsmodule_internal)',
- ],
- 'outputs': [
- '<(fipsmodule)',
- ],
- 'action': [
- '<(python)', 'tools/copyfile.py',
- '<(fipsmodule_internal)',
- '<(fipsmodule)',
- ],
- },
- {
- 'action_name': 'copy_openssl_cnf_and_include_fips_cnf',
- 'inputs': [ '<(opensslconfig)', ],
- 'outputs': [ '<(opensslconfig_internal)', ],
- 'action': [
- '<(python)', 'tools/enable_fips_include.py',
- '<(opensslconfig)',
- '<(opensslconfig_internal)',
- '<(fipsconfig)',
- ],
- },
+ ],
+ 'variables': {
+ 'opensslconfig_internal': '<(obj_dir)/deps/openssl/openssl.cnf',
+ 'opensslconfig': './deps/openssl/nodejs-openssl.cnf',
+ },
+ 'actions': [
+ {
+ 'action_name': 'reset_openssl_cnf',
+ 'inputs': [ '<(opensslconfig)', ],
+ 'outputs': [ '<(opensslconfig_internal)', ],
+ 'action': [
+ '<(python)', 'tools/copyfile.py',
+ '<(opensslconfig)',
+ '<(opensslconfig_internal)',
],
- }, {
- 'variables': {
- 'opensslconfig_internal': '<(obj_dir)/deps/openssl/openssl.cnf',
- 'opensslconfig': './deps/openssl/nodejs-openssl.cnf',
- },
- 'actions': [
- {
- 'action_name': 'reset_openssl_cnf',
- 'inputs': [ '<(opensslconfig)', ],
- 'outputs': [ '<(opensslconfig_internal)', ],
- 'action': [
- '<(python)', 'tools/copyfile.py',
- '<(opensslconfig)',
- '<(opensslconfig_internal)',
- ],
- },
- ],
- }],
+ },
],
}, # node_core_target_name
{
diff --git a/src/crypto/README.md b/src/crypto/README.md
index ad06cf989276..01b1ff082adf 100644
--- a/src/crypto/README.md
+++ b/src/crypto/README.md
@@ -95,8 +95,8 @@ using CipherCtxPointer = DeleteFnPtr;
Examples of these being used are pervasive through the `src/crypto` code.
`HMACCtxPointer` is a dedicated HMAC state wrapper rather than a plain
-`DeleteFnPtr` alias. On OpenSSL 3 and later it owns the provider-backed
-`EVP_MAC`/`EVP_MAC_CTX` state. On OpenSSL 1.1.1 and BoringSSL it owns the
+`DeleteFnPtr` alias. On OpenSSL it owns the provider-backed
+`EVP_MAC`/`EVP_MAC_CTX` state. On BoringSSL it owns the
legacy `HMAC_CTX` state. HMAC call sites should use `HMACCtxPointer::New()`,
`init()`, `update()`, and `digest()`/`digestInto()` so the backend selection
stays contained in ncrypto.
diff --git a/src/crypto/crypto_cipher.cc b/src/crypto/crypto_cipher.cc
index 92682328d0ba..1f1dcf3949ed 100644
--- a/src/crypto/crypto_cipher.cc
+++ b/src/crypto/crypto_cipher.cc
@@ -719,8 +719,8 @@ bool CipherBase::Final(std::unique_ptr* out) {
static_cast(ctx_.getBlockSize()),
BackingStoreInitializationMode::kUninitialized);
-#if !OPENSSL_VERSION_PREREQ(3, 0)
- // OpenSSL v1.x doesn't verify the presence of the auth tag so do
+#ifdef OPENSSL_IS_BORINGSSL
+ // BoringSSL doesn't verify the presence of the auth tag so do
// it ourselves, see https://github.com/nodejs/node/issues/45874.
if (kind_ == kDecipher && ctx_.isChaCha20Poly1305() &&
auth_tag_state_ != kAuthTagSetByUser) {
diff --git a/src/crypto/crypto_context.cc b/src/crypto/crypto_context.cc
index 0f61767cdbbe..54f41ba64f4a 100644
--- a/src/crypto/crypto_context.cc
+++ b/src/crypto/crypto_context.cc
@@ -1645,7 +1645,7 @@ void SecureContext::Init(const FunctionCallbackInfo& args) {
// SSLv3 is disabled because it's susceptible to downgrade attacks (POODLE.)
SSL_CTX_set_options(sc->ctx_.get(), SSL_OP_NO_SSLv2);
SSL_CTX_set_options(sc->ctx_.get(), SSL_OP_NO_SSLv3);
-#if OPENSSL_VERSION_MAJOR >= 3
+#ifndef OPENSSL_IS_BORINGSSL
SSL_CTX_set_options(sc->ctx_.get(), SSL_OP_ALLOW_CLIENT_RENEGOTIATION);
#endif
@@ -2366,7 +2366,7 @@ void SecureContext::LoadPKCS12(const FunctionCallbackInfo& args) {
// TODO(@jasnell): Should this use ThrowCryptoError?
unsigned long err = ERR_get_error(); // NOLINT(runtime/int)
-#if OPENSSL_VERSION_MAJOR >= 3
+#ifndef OPENSSL_IS_BORINGSSL
if (ERR_GET_REASON(err) == ERR_R_UNSUPPORTED) {
// OpenSSL's "unsupported" error without any context is very
// common and not very helpful, so we override it:
diff --git a/src/crypto/crypto_dh.cc b/src/crypto/crypto_dh.cc
index 92780cfeeebf..28ee5783c798 100644
--- a/src/crypto/crypto_dh.cc
+++ b/src/crypto/crypto_dh.cc
@@ -92,20 +92,14 @@ MaybeLocal DataPointerToBuffer(Environment* env, DataPointer&& data) {
void PutDhError(int reason) {
#ifdef OPENSSL_IS_BORINGSSL
OPENSSL_PUT_ERROR(DH, reason);
-#elif NCRYPTO_USE_OPENSSL3_PROVIDER
- ERR_raise(ERR_LIB_DH, reason);
#else
- ERR_put_error(ERR_LIB_DH, 0, reason, __FILE__, __LINE__);
+ ERR_raise(ERR_LIB_DH, reason);
#endif
}
-#if defined(OPENSSL_IS_BORINGSSL) || !NCRYPTO_USE_OPENSSL3_PROVIDER
-void PutBnError(int reason) {
#ifdef OPENSSL_IS_BORINGSSL
+void PutBnError(int reason) {
OPENSSL_PUT_ERROR(BN, reason);
-#else
- ERR_put_error(ERR_LIB_BN, 0, reason, __FILE__, __LINE__);
-#endif
}
#endif
@@ -134,11 +128,7 @@ void New(const FunctionCallbackInfo& args) {
int32_t bits = args[0].As()->Value();
if (bits < 2) {
#ifndef OPENSSL_IS_BORINGSSL
-#if OPENSSL_VERSION_MAJOR >= 3
PutDhError(DH_R_MODULUS_TOO_SMALL);
-#else
- PutBnError(BN_R_BITS_TOO_SMALL);
-#endif // OPENSSL_VERSION_MAJOR >= 3
#else // OPENSSL_IS_BORINGSSL
PutBnError(BN_R_BITS_TOO_SMALL);
#endif // OPENSSL_IS_BORINGSSL
diff --git a/src/crypto/crypto_hash.cc b/src/crypto/crypto_hash.cc
index dd69428c17e5..81f77d051e24 100644
--- a/src/crypto/crypto_hash.cc
+++ b/src/crypto/crypto_hash.cc
@@ -79,7 +79,7 @@ constexpr BoringSSLDigest kBoringSSLDigests[] = {
};
#endif
-#if OPENSSL_VERSION_MAJOR >= 3
+#ifndef OPENSSL_IS_BORINGSSL
void PushAliases(const char* name, void* data) {
static_cast*>(data)->push_back(name);
}
@@ -155,7 +155,7 @@ void SaveSupportedHashAlgorithms(const EVP_MD* md,
Environment* env = static_cast(arg);
env->supported_hash_algorithms.push_back(from);
}
-#endif // OPENSSL_VERSION_MAJOR >= 3
+#endif // !OPENSSL_IS_BORINGSSL
const std::vector& GetSupportedHashAlgorithms(Environment* env) {
if (env->supported_hash_algorithms.empty()) {
@@ -165,7 +165,7 @@ const std::vector& GetSupportedHashAlgorithms(Environment* env) {
static_cast(digest.get);
env->supported_hash_algorithms.emplace_back(digest.name);
}
-#elif OPENSSL_VERSION_MAJOR >= 3
+#elif !defined(OPENSSL_IS_BORINGSSL)
// Since we'll fetch the EVP_MD*, cache them along the way to speed up
// later lookups instead of throwing them away immediately.
EVP_MD_do_all_sorted(SaveSupportedHashAlgorithmsAndCacheMD, env);
@@ -194,7 +194,7 @@ void Hash::GetCachedAliases(const FunctionCallbackInfo& args) {
size_t size = env->alias_to_md_id_map.size();
LocalVector names(isolate);
LocalVector values(isolate);
-#if OPENSSL_VERSION_MAJOR >= 3
+#ifndef OPENSSL_IS_BORINGSSL
names.reserve(size);
values.reserve(size);
for (auto& [alias, id] : env->alias_to_md_id_map) {
@@ -218,7 +218,7 @@ const EVP_MD* GetDigestImplementation(Environment* env,
CHECK(cache_id_val->IsInt32());
CHECK(algorithm_cache->IsObject());
-#if OPENSSL_VERSION_MAJOR >= 3
+#ifndef OPENSSL_IS_BORINGSSL
int32_t cache_id = cache_id_val.As()->Value();
if (cache_id != -1) { // Alias already cached, return the cached EVP_MD*.
return GetCachedMDByID(env, cache_id);
@@ -266,7 +266,7 @@ void MarkInvalidXofLength() {
// version-independent.
#if !OPENSSL_VERSION_PREREQ(3, 4)
bool IsShakeDigest(const EVP_MD* md) {
-#if OPENSSL_VERSION_MAJOR >= 3
+#ifndef OPENSSL_IS_BORINGSSL
return EVP_MD_is_a(md, "SHAKE128") || EVP_MD_is_a(md, "SHAKE256");
#else
const char* name = OBJ_nid2sn(EVP_MD_type(md));
diff --git a/src/crypto/crypto_keys.cc b/src/crypto/crypto_keys.cc
index b4e3aa72292f..bb74bb74a1fe 100644
--- a/src/crypto/crypto_keys.cc
+++ b/src/crypto/crypto_keys.cc
@@ -1337,7 +1337,7 @@ void KeyObjectHandle::Equals(const FunctionCallbackInfo& args) {
case kKeyTypePrivate: {
EVP_PKEY* pkey = key.GetAsymmetricKey().get();
EVP_PKEY* pkey2 = key2.GetAsymmetricKey().get();
-#if OPENSSL_VERSION_MAJOR >= 3
+#ifndef OPENSSL_IS_BORINGSSL
int ok = EVP_PKEY_eq(pkey, pkey2);
#else
int ok = EVP_PKEY_cmp(pkey, pkey2);
diff --git a/src/crypto/crypto_tls.cc b/src/crypto/crypto_tls.cc
index 8ef74aee2d0e..c0bb346cfbb4 100644
--- a/src/crypto/crypto_tls.cc
+++ b/src/crypto/crypto_tls.cc
@@ -81,7 +81,7 @@ namespace {
// that the user user Connection::VerifyError after the `secure`
// callback has been made.
int VerifyCallback(int preverify_ok, X509_STORE_CTX* ctx) {
- // From https://www.openssl.org/docs/man1.1.1/man3/SSL_verify_cb:
+ // From https://www.openssl.org/docs/man3.0/man3/SSL_verify_cb:
//
// If VerifyCallback returns 1, the verification process is continued. If
// VerifyCallback always returns 1, the TLS/SSL handshake will not be
diff --git a/src/crypto/crypto_util.cc b/src/crypto/crypto_util.cc
index 166fea15da59..930c4cdc36dd 100644
--- a/src/crypto/crypto_util.cc
+++ b/src/crypto/crypto_util.cc
@@ -14,7 +14,7 @@
#include "math.h"
-#if OPENSSL_VERSION_MAJOR >= 3
+#ifndef OPENSSL_IS_BORINGSSL
#include "openssl/provider.h"
#endif
@@ -104,7 +104,7 @@ std::optional ProcessFipsOptions() {
const bool force_fips = per_process::cli_options->force_fips_crypto;
if (!enable_fips && !force_fips) return std::nullopt;
-#if OPENSSL_VERSION_MAJOR >= 3
+#ifndef OPENSSL_IS_BORINGSSL
// Whether FIPS-approved implementations are reachable is decided by the
// OpenSSL configuration, not by Node.js. Refuse to start rather than
// restrict the default property query to a provider that is not there,
@@ -152,15 +152,6 @@ void InitCryptoOnce() {
#ifndef OPENSSL_IS_BORINGSSL
OPENSSL_INIT_SETTINGS* settings = OPENSSL_INIT_new();
-#if OPENSSL_VERSION_MAJOR < 3
- // --openssl-config=...
- if (!per_process::cli_options->openssl_config.empty()) {
- const char* conf = per_process::cli_options->openssl_config.c_str();
- OPENSSL_INIT_set_config_filename(settings, conf);
- }
-#endif
-
-#if OPENSSL_VERSION_MAJOR >= 3
// --openssl-legacy-provider
if (per_process::cli_options->openssl_legacy_provider) {
OSSL_PROVIDER* legacy_provider = OSSL_PROVIDER_load(nullptr, "legacy");
@@ -168,7 +159,6 @@ void InitCryptoOnce() {
fprintf(stderr, "Unable to load legacy provider.\n");
}
}
-#endif
OPENSSL_init_ssl(0, settings);
diff --git a/src/env.h b/src/env.h
index c2caf9790238..1922763724c9 100644
--- a/src/env.h
+++ b/src/env.h
@@ -1069,11 +1069,11 @@ class Environment final : public MemoryRetainer {
};
#if HAVE_OPENSSL
-#if OPENSSL_VERSION_MAJOR >= 3
+#ifndef OPENSSL_IS_BORINGSSL
// We declare another alias here to avoid having to include crypto_util.h
using EVPMDPointer = DeleteFnPtr;
std::vector evp_md_cache;
-#endif // OPENSSL_VERSION_MAJOR >= 3
+#endif // !OPENSSL_IS_BORINGSSL
std::unordered_map alias_to_md_id_map;
std::vector supported_hash_algorithms;
#endif // HAVE_OPENSSL
diff --git a/src/node.cc b/src/node.cc
index b5455fe40356..a167841157de 100644
--- a/src/node.cc
+++ b/src/node.cc
@@ -50,7 +50,7 @@
#if HAVE_OPENSSL
#include "ncrypto.h"
#include "node_crypto.h"
-#if OPENSSL_VERSION_MAJOR >= 3 && !defined(CONF_MFLAGS_IGNORE_MISSING_FILE)
+#if !defined(OPENSSL_IS_BORINGSSL) && !defined(CONF_MFLAGS_IGNORE_MISSING_FILE)
// OpenSSL hides this deprecated macro under OPENSSL_NO_DEPRECATED, but the
// non-deprecated OPENSSL_INIT settings API still accepts the flag value.
#define CONF_MFLAGS_IGNORE_MISSING_FILE 0x10
@@ -1168,7 +1168,6 @@ InitializeOncePerProcessInternal(const std::vector& args,
if (!(flags & ProcessInitializationFlags::kNoInitOpenSSL)) {
#if HAVE_OPENSSL
#ifndef OPENSSL_IS_BORINGSSL
-#if OPENSSL_VERSION_MAJOR >= 3
auto GetOpenSSLErrorString = []() -> std::string {
std::string ret;
ERR_print_errors_cb(
@@ -1184,6 +1183,7 @@ InitializeOncePerProcessInternal(const std::vector& args,
// In the case of FIPS builds we should make sure
// the random source is properly initialized first.
+ //
// Call OPENSSL_init_crypto to initialize OPENSSL_INIT_LOAD_CONFIG to
// avoid the default behavior where errors raised during the parsing of the
// OpenSSL configuration file are not propagated and cannot be detected.
@@ -1239,11 +1239,7 @@ InitializeOncePerProcessInternal(const std::vector& args,
GetOpenSSLErrorString());
return result;
}
-#else // OPENSSL_VERSION_MAJOR < 3
- if (FIPS_mode()) {
- OPENSSL_init();
- }
-#endif
+
if (auto fips_error = crypto::ProcessFipsOptions()) {
result->exit_code_ = ExitCode::kGenericUserError;
result->early_return_ = true;
diff --git a/src/node_config.cc b/src/node_config.cc
index 7245d9130d03..2de1ee244ddb 100644
--- a/src/node_config.cc
+++ b/src/node_config.cc
@@ -64,8 +64,6 @@ static void InitConfig(Local