import cv2 aborts with OpenSSL internal error: FATAL FIPS SELFTEST FAILURE on OpenSSL 3.0.x [opencv-python 4.13.0.90]

[Nailujj]

On a Debian/Ubuntu-based environment using OpenSSL 3.0.x, importing OpenCV (import cv2) aborts the Python process with an OpenSSL FIPS self-test failure:

crypto/fips/fips.c:154: OpenSSL internal error: FATAL FIPS SELFTEST FAILURE
Aborted (core dumped)

This is a hard abort (exit code 134), not a Python exception.

Using an older OpenCV version works as expected in the same environment.

Steps to reproduce (I am on Databricks but I assume other environments will have similar issues)

1. Create a clean environment (e.g., Databricks / Debian-based container / Ubuntu).

2. Install OpenCV (newest version):

pip install opencv-python

3. Run:

python -c "import cv2; print(cv2.version)"

Actual result
crypto/fips/fips.c:154: OpenSSL internal error: FATAL FIPS SELFTEST FAILURE
Aborted (core dumped)

Expected result
import cv2 should succeed and print the OpenCV version.

Environment:

OS: Debian/Ubuntu-based (e.g. Databricks runtime / Linux x86_64)

Python: 3.12

[afoley587]

We saw this as well on databricks runtimes. We were able to fix it with the following:

import os
os.environ.pop("OPENSSL_FORCE_FIPS_MODE", None)

import cv2
print(cv2.__version__)

It's odd that, even if OPENSSL_FORCE_FIPS_MODE was unset, popping it from the environment helped.

[Nailujj]

Thanks! Appears to work.

[whentheworldfallsapart]

afoley587 suggestion didn't work for me. I had to drop to opencv-python==4.12.0.88 opencv-python-headless==4.12.0.88 which does not have the FATAL FIPS SELFTEST FAILURE error

[russellb]

Has this only been observed in a databricks environment? It sounds like it based on the comments so far. and the problem is only if OPENSSL_FORCE_FIPS_MODE is set?

[Nailujj]

@russellb yes, and yes. I just confirmed it.

[neverpanic]

OPENSSL_FORCE_FIPS_MODE is not an upstream feature, and downstream distros differ in how they interpret it. Generally, people that run their OpenSSL in FIPS mode want to be compliant. I believe the issue here might be that Ubuntu interprets OPENSSL_FORCE_FIPS_MODE=0 as instruction to disable FIPS mode, but Fedora/RHEL's OpenSSL interprets the presence of the variable as instruction to force-enable FIPS mode.

Correct me if I'm wrong, but I believe OpenCV bundles a copy of OpenSSL 1.1 from CentOS/RHEL in its wheels, which then triggers this. I believe there are two things wrong here:

• databricks shouldn't set OPENSSL_FORCE_FIPS_MODE=0. Users that have FIPS mode enabled probably don't want to silently use non-FIPS crypto and may want to see a failure instead of non-FIPS cryptography
• OpenCV should probably move to an upstream build of the latest OpenSSL, like python-cryptography does, for example.

[whentheworldfallsapart]

@russellb

Has this only been observed in a databricks environment?

I was not using a databricks env