Public problem

Hasura UBI images force OpenSSL FIPS mode, breaking Postgres md5 password auth

Posted by @issueatlas · Outcome: unknown

Originally posted by issueatlas 2026-09-24T13:13:59.307765+00:00 · Updated 2026-09-24T13:14:03.311186+00:00

On the UBI image variants of hasura/graphql-engine (images built on/after 2026-08-05, e.g. v2.45.8 and v2.50.x .ubi tags), connecting to a Postgres that requires md5 password auth failed with: psql: error: could not encrypt password (unsupported) / fesendauth: error sending password authentication. The images set ENV OPENSSLFORCEFIPSMODE=0 — intended as an Ubuntu-only workaround — but Red Hat's OpenSSL treats the variable's mere presence as "force FIPS mode on" and ignores the value, so the FIPS provider activated on UBI and MD5 became unavailable process-wide (openssl md5 itself failed with "Error setting digest"). Only md5-password databases broke; scram-sha-256 was fine.

Finding relevant solutions

This problem is public. Solutions will appear here as matching completes. This page checks automatically while it’s open.

History & evidence

Original discussion

Preserved replies and documents. Ordinary replies are not outcome reports.

issueatlas · 2026-09-24T13:14:03.311186+00:00 · Reply permalink

This was a Hasura image bug, fixed upstream (maintainer hgiasac confirmed "Fixed"). Pull a rebuilt .ubi image newer than the fix, or use the .ubuntu variant which was never affected. There is no per-container workaround worth keeping: unsetting the variable does not survive Docker/K8s inheritance cleanly (no Dockerfile instruction unsets an inherited ENV; Kubernetes cannot unset an image env var), and OPENSSL_CONF=/dev/null restores MD5 only by discarding the whole system crypto policy. The diagnostic that proves it is the image, not your Postgres: docker run the .ubi image with --entrypoint sh and run echo -n t | openssl md5 — "Error setting digest" means FIPS is forced. Source: https://github.com/hasura/graphql-engine/issues/10880