After configuring the cnf file for oqs-provider, unable to use wget, why ?

[gobbledy-gook]

I did the following for re-configuring the openssl.cnf file for it to be able to use the oqs-provider

cd /opt/oqs-provider
ln -s ../openssl . 
cmake -DOPENSSL_ROOT_DIR=${INSTALLDIR} -DCMAKE_BUILD_TYPE=Release -DCMAKE_PREFIX_PATH=${INSTALLDIR} -S . -B _build
cmake --build _build
cp _build/lib/oqsprovider.so ${INSTALLDIR}/lib64/ossl-modules
sed -i "s/default = default_sect/default = default_sect\noqsprovider = oqsprovider_sect/g" /opt/oqssa/ssl/openssl.cnf
sed -i "s/\[default_sect\]/\[default_sect\]\nactivate = 1\n\[oqsprovider_sect\]\nactivate = 1\n/g" /opt/oqssa/ssl/openssl.cnf
sed -i "s/providers = provider_sect/providers = provider_sect\nssl_conf = ssl_sect\n\n\[ssl_sect\]\nsystem_default = system_default_sect\n\n\[system_default_sect\]\nGroups = \$ENV\:\:DEFAULT_GROUPS\n/g" /opt/oqssa/ssl/openssl.cnf 
sed -i "s/\# Use this in order to automatically load providers/\# Set default KEM groups if not set via environment variable\nKDEFAULT_GROUPS = $DEFAULT_GROUPS\n\n# Use this in order to automatically load providers/g" /opt/oqssa/ssl/openssl.cnf 
sed -i "s/HOME\t\t\t= ./HOME\t\t= .\nDEFAULT_GROUPS\t= ${DEFAULT_GROUPS}/g" /opt/oqssa/ssl/openssl.cnf

This is derived from what is described at line73 of https://github.com/open-quantum-safe/oqs-demos/blob/main/curl/Dockerfile

To check if the provider is successfully added I did

{$OPENSSL} -providers -verbose

I got the desired output (OQS-provider was listed in the output)

Next when I tried to run the wget command to fetch from https://letsencrypt.org/certs/isrgrootx1.pem, I got the following error

--2024-09-16 17:28:21--  https://letsencrypt.org/certs/isrgrootx1.pem
Could not seed PRNG; consider using --random-file.
OpenSSL: error:0308010C:digital envelope routines::unsupported
OpenSSL: error:12000090:random number generator::unable to fetch drbg
Disabling SSL due to encountered errors.

I am stuck at this. Why wget is not working and what can I do to fix this? (Anyways I download the .pem file but this shouldn't be the expected output hence, the discussion)

My goal is to replicate the process to integrate OPENSSLv3 with liboqs to use it with curl and then extrapolate it for the liboqs-python. Any help would be highly appreciated.
Also, lemme know in case if I should add more details to the question.

Edit:
Environment Variables in use:

set -x OPENSSL /opt/oqssa/bin/openssl
set -x OPENSSL_CNF /opt/oqssa/ssl/openssl.cnf

[beldmit]

Looks like you don't have default provider active anymore. Try openssl list -providers

[gobbledy-gook]

I don't think thats an issue. Output to this is

Providers:
  default
    name: OpenSSL Default Provider
    version: 3.5.0
    status: active
    build info: 3.5.0-dev
    gettable provider parameters:
      name: pointer to a UTF8 encoded string (arbitrary size)
      version: pointer to a UTF8 encoded string (arbitrary size)
      buildinfo: pointer to a UTF8 encoded string (arbitrary size)
      status: integer (arbitrary size)
  oqsprovider
    name: OpenSSL OQS Provider
    version: 0.6.2-dev
    status: active
    build info: OQS Provider v.0.6.2-dev (4db09a9) based on liboqs v.0.10.2-dev
    gettable provider parameters:
      name: pointer to a UTF8 encoded string (arbitrary size)
      version: pointer to a UTF8 encoded string (arbitrary size)
      buildinfo: pointer to a UTF8 encoded string (arbitrary size)
      status: integer (arbitrary size)
      

[baentsch]

As far as I remember (but may be wrong) openssl list -providers is no guarantee that curl or wget picks up the config file properly, too (which doesn't seem to be the case here). Which env var did you set, @gobbledy-gook ? OPENSSL_CONF? Looking at https://github.com/open-quantum-safe/oqs-demos/blob/6e31ae7c5447ce3c6ba7ea3a111dc26b8b603c5e/curl/Dockerfile#L123 there seems to be an error setting OPENSSL_CNF.... Just wonder how/why this works...

[baentsch]

Also, lemme know in case if I should add more details to the question.

To be sure, please share all env vars, their values and in particular, the contents of the openssl.cnf file you (think you :) use, @gobbledy-gook

[baentsch]

To me this looks like progress: It seems the openssl.cnf file is broken. Can you share its contents? Does openssl list -providers still return the same output?

[gobbledy-gook]

Is it okay to share the configuration file content on a public platform? I am not sure about it!

Yes the openssl list -providers works just fine.

[gobbledy-gook]

Following are the updates that were made after running the above commands in openssl.cnf file:

# List of providers to load
[provider_sect]
default = default_sect
oqsprovider = oqsprovider_sect 

[default_sect]
activate = 1
[oqsprovider_sect]
activate = 1

[openssl_init]
providers = provider_sect
ssl_conf = ssl_sect

[ssl_sect]
system_default = system_default_sect

[system_default_sect]
Groups =  $ENV::DEFAULT_GROUPS

# Set the default KEM groups if not set via environment variable
KDEFAULT_GROUPS = $DEFAULT_GROUPS

# Use this in order to automatically load providers
openssl_cnf = openssl_init

# This definition stops the following lines from choking if HOME isn't defined
 HOME = .
 DEFAULT_GROUPS = x25519:x448:kyber512:p256_kyber512:kyber768:p384_kyber768:kyber1024:p521_kyber1024

[baentsch]

Thanks for sharing @gobbledy-gook . Looks somewhat familiar.

Is it okay to share the configuration file content on a public platform?

Of course. This (GH) is such public platform. What (else) do you have in mind?

[gobbledy-gook]

Actually this got resolved. I apologise for not updating. I should close this discussion.