Agent continuously logs error on FIPS compliant server

[linuxelf001]

Issue is reproduced on RHEL 6.8 test server {Dated: 04/12/2017}. Initially, FIPS mode is disabled

cat /proc/sys/crypto/fips_enabled
0

then enabled FIPS

cat /proc/sys/crypto/fips_enabled
1

Rebooted the server. After the agent restart, below messages are repeated in /var/log/waagent.log

2017/04/12 20:45:37.445520 ERROR run cmd '/usr/bin/openssl cms -decrypt -in /var/lib/waagent/Certificates.p7m -inkey /var/lib/waagent/TransportPrivate.pem -recip /var/lib/waagent/TransportCert.pem | /usr/bin/openssl pkcs12 -nodes -password pass: -out /var/lib/waagent/Certificates.pem' failed

2017/04/12 20:45:37.487112 ERROR Error Code:1
2017/04/12 20:45:37.493113 ERROR Result:MAC verified OK
Error outputting keys and certificates
140499593189192:error:060740A0:digital envelope routines:EVP_PBE_CipherInit:unknown cipher:evp_pbe.c:186:
140499593189192:error:23077073:PKCS12 routines:PKCS12_pbe_crypt:pkcs12 algor cipherinit error:p12_decr.c:83:
140499593189192:error:2306A075:PKCS12 routines:PKCS12_item_decrypt_d2i:pkcs12 pbe crypt error:p12_decr.c:130:

[hglkrijger]

@linuxelf001 this is expected since the agent does not support FIPS today.

[brendandixon]

Reopening to trace investigation / implementation.

[brendandixon]

Addressed by #690

[johanburati]

I have enabled FIPS on the Marketplace RHEL 7.4 image (kernel 3.10.0-693.el7.x86_64) and I can see the same error messages in waagent.log

version

waagent -version
WALinuxAgent-2.2.14 running on redhat 7.4
Python: 2.7.5
Goal state agent: 2.2.17

log

2017/09/21 04:29:49.386418 ERROR Command: '/usr/bin/openssl cms -decrypt -in /var/lib/waagent/Certificates.p7m -inkey /var/lib/waagent/TransportPrivate.pem -recip /var/lib/waagent/TransportCert.pem | /usr/bin/openssl pkcs12 -nodes -passw
ord pass: -out /var/lib/waagent/Certificates.pem'
2017/09/21 04:29:49.413085 ERROR Return code: 1
2017/09/21 04:29:49.418465 ERROR Result: MAC verified OK
Error outputting keys and certificates
140528231827360:error:060740A0:digital envelope routines:EVP_PBE_CipherInit:unknown cipher:evp_pbe.c:181:
140528231827360:error:23077073:PKCS12 routines:PKCS12_pbe_crypt:pkcs12 algor cipherinit error:p12_decr.c:87:
140528231827360:error:2306A075:PKCS12 routines:PKCS12_item_decrypt_d2i:pkcs12 pbe crypt error:p12_decr.c:139: