Skip to content

Conversation

@madeline-shao-db
Copy link
Contributor

@madeline-shao-db madeline-shao-db commented Oct 27, 2025

When running in FIPS mode, click fails to connect to kind clusters with PKCS12 parsing errors. This occurs because click uses native-tls (OpenSSL) for IP-based connections, which internally converts PEM certificates to PKCS12 format and uses cryptographic algorithms that are disabled in FIPS mode.

[WARN] Couldn't find/load context kind-11e7gikg, now no current context. Error: Reqwest error: builder error: error:0607B0C8:digital envelope routines:EVP_CipherInit_ex:disabled for FIPS:../crypto/evp/evp_enc.c:227:, error:06074078:digital envelope routines:EVP_PBE_CipherInit:keygen failure:../crypto/evp/evp_pbe.c:130:, error:23077073:PKCS12 routines:PKCS12_pbe_crypt:pkcs12 algor cipherinit error:../crypto/pkcs12/p12_decr.c:40:, error:2306A075:PKCS12 routines:PKCS12_item_decrypt_d2i:pkcs12 pbe crypt error:../crypto/pkcs12/p12_decr.c:93:, error:23076072:PKCS12 routines:PKCS12_parse:parse error:../crypto/pkcs12/p12_kiss.c:83:

Instead use rustls for all connections since it doesn't use OpenSSL. This PR also removes all PKCS12-related code paths and dependencies.

Testing

cargo test
and cargo run on FIPS-enabled Linux system connecting to clusters via IP address.

@nicklan nicklan merged commit fcaf933 into databricks:master Oct 29, 2025
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants