BN_lebin2bn used, but not available in AWS-LC-FIPS

[xnox]

Microsoft build of Go version

go1.25

What is your operating system and platform?

Some Amazon Bottlerocket, likely 1.45

Output of go env in your module/workspace:

n/a

What did you do?

Build and run go binary on bottlerocket 1.45

What did you see happen?

Cannot get required symbol "BN_lebin2bn" from libcrypto version 1.1
SIGABRT: abort
...
vendor/github.com/golang-fips/openssl/v2._Cfunc_go_openssl_load_functions
...

What did you expect to see?

Some sensible warning that OpenSSL 1.0 is no longer supported.

Or the application just working, and using other symbols that are available in OpenSSL 1.0.2k-fips 26 Jan 2017

Based on known-versions I thought 1.0.2 is still supported.

Maybe ECDSA code paths are triggered, when ECDSA is not supported at all, or some such? Or is this an issue from bind-now linking?

[dagood]

Cannot get required symbol "BN_lebin2bn" from libcrypto version 1.1

I'm a little puzzled by this string. The "from libcrypto version" bit is present in 1.24, but not 1.25. (Or at least I can't find a place where it might come from in 1.25.) The 1.1 seems to indicate that it found OpenSSL 1.1 and is trying to load it, not a 1.0. Maybe the system has a weird symlink from 1.1 -> 1.0? Could try GO_OPENSSL_VERSION_OVERRIDE to work around that if that's the case.

As you suspect, 1.0 is no longer supported in 1.25.

• Remove OpenSSL 1.0.2 support golang-fips/openssl#248
• Remove OpenSSL 1.0.2 support golang-fips/openssl#244

---

About support: https://github.com/golang-fips/openssl?tab=readme-ov-file#multiple-openssl-versions-supported is up to date, but IMO we're missing updates to:

• https://github.com/microsoft/go/blob/microsoft/main/eng/doc/fips/README.md#go-125-aug-2025
• https://github.com/microsoft/go/blob/microsoft/main/eng/doc/fips/README.md#multiple-openssl-versions-allowed

• go/patches/0003-Implement-crypto-internal-backend.patch

  Line 2000 in 27cc46e

  +var knownVersions = [...]string{"3", "1.1", "11", "111", "1.0.2", "1.0.0", "10"}

  • I think that updating this will change this to be a clearer error case, although maybe there's more we can do for 1.0 to make it specifically super clear.
• https://devblogs.microsoft.com/go/microsoft-go-defaults-to-system-crypto/
• https://github.com/microsoft/go/releases/tag/v1.25.0-1

We also don't have a ms-go1.25-support branch in https://github.com/golang-fips/openssl yet to make it clearer if v2 has advanced past what's in 1.25. (Not yet.)

@qmuntal @gdams

[xnox]

@dagood thank you; yeah, i would have expected that knownVersions is updated.

let me figure out what I can do here.

[xnox]

oooh, pondering if it actually is aws-lc-fips masquarading as openssl. As that is the only sane explanation of how come it reports 11 abi without the openssl 11 symbols.