Support Go native FIPS 140 mode (GODEBUG=fips140=only)
Maintainers usually reply within 2 days
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 48/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- go
- Domain
- cryptography, security
Research direction
Locate ComputeSKI, FillTemplate, and the other cryptographic helpers named in the issue, then inspect their callers and run the relevant package tests with GODEBUG=fips140=only. Confirm which suggested approach is selected; done means cfssl operates in native FIPS mode without non-FIPS runtime failures while preserving the default behavior unless configured otherwise.
Written by the indexing model from the issue text.
Description
Go 1.24 introduced native FIPS 140-3 support via GODEBUG=fips140=only, which rejects all non-FIPS algorithms at runtime, including crypto/sha1.
cfssl uses SHA-1 in several hardcoded places that can't be configured:
ComputeSKI(): hardcodedsha1.Sum()forSubjectKeyIdcomputation, no option to use SHA-256FillTemplate(): unconditionally callsComputeSKI(), overwriting any pre-set SubjectKeyId- Various helpers: use crypto primitives that trigger
fips140=onlypanics
While SHA-1 for SKI is recommended by RFC 5280 §4.2.1.2, it's not mandatory, the RFC allows any method that provides unique identification. SHA-256 truncated to 20 bytes is a FIPS-compliant alternative.
Suggested fixes (any of):
- Make the SKI hash algorithm configurable (default SHA-1, option for SHA-256)
- Don't overwrite SubjectKeyId in FillTemplate if the caller already set it
- Detect fips140=only at runtime and switch to SHA-256 automatically
- Dominant language
- Go
- Stars
- 9.5k
- Forks
- 1.2k
- Avg merge
- 12h 48m
- Merged PRs (30d)
- 2
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from cloudflare/cfssl
-
gencrl: serial numbers that fail to parse are added to the CRL as 0 or a partial valuePossibly taken @sebxt claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
cloudflare/cfssl#1460 ·
Maintainers usually reply within 2 days
-
`Bundler.BundleFromRemote` fails for IPv6 address literalsPossibly taken @reginaldalfret claimed this 14 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
cloudflare/cfssl#1448 ·
Maintainers usually reply within 2 days
-
crl_override (and extensions) in /api/v1/sign request body are silently ignored by the HTTP APIPossibly taken @Hashim1999164 claimed this 69 days ago. Open
Difficulty 2/5 Half a day Newbie friendliness 78/100
cloudflare/cfssl#1439 ·
Maintainers usually reply within 2 days
-
gencrl silently revokes the wrong serial number when a line is not plain decimalPossibly taken @RaphaelFakhri claimed this 2 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 30/100
cloudflare/cfssl#1458 ·
Maintainers usually reply within 2 days
-
config: LoadConfig panics when not_after is before not_beforePossibly taken @sebxt claimed this 3 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 25/100
cloudflare/cfssl#1456 ·
Maintainers usually reply within 2 days
All issues in cloudflare/cfssl
Similar issues
-
usage: a custom provider's balance meters ("…%" in the balance path) ignore the Left/Used switchOpen
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day
-
bug iam-service
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
platform-mesh/platform-mesh#425 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
grafana/tempo-operator#1691 ·
Maintainers usually reply within 1 day
-
fix: presentation.go with mcp-table.go: the message for each MCP server comes backPossibly taken @mge1512 claimed this today. Openbug
Difficulty 1/5 1-3 hours Newbie friendliness 78/100
mark3labs/kit#242 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 85/100
slavakurilyak/awesome-ai-agents#827 ·
Maintainers usually reply within 1 day