FIPS 140-2 compliancy using existing certified libraries #37072
Description
Is your feature request related to a problem? Please describe.
A number of applications that could be FIPS 140-2 compliant simply can't be because the last version of NodeJS that supports being built with certified OpenSSL libraries was v8.x (using the 1.02g libraries). Although I can't find it, I had read a couple of years ago that there was strong consideration of NodeJS v13 being able to be either certified or compliant, but all of the searching that I've done hasn't come up with any mention of that (or any later version) having that capability.
As stated, I'm already using NodeJS v8 in order to run applications that require NodeJS, and so far that has worked out remarkably well considering the age of v8: even newer changes to the upper stack of applications appear to run just fine on this long in the tooth version. However, of course v8 has a number of CVEs that have been addressed in latter versions: but those latter versions can't be compiled using the OpenSSL 1.02g libraries. Added to this is the fact that 1.02g doesn't support TLS1.2+ and with modern browsers no longer supporting TLS1.0/1.1 from March 2021 ... you can see the predicament.
Describe the solution you'd like
I'm not a programmer first and foremost, but I've assisted other projects in the same sort of vein, and that is: if I'm running an OS that has gone through FIPS 140-2 certification of the OpenSSL libraries, those other projects have altered their build scripts to be able to compile by linking to the existing libraries already on the system, thereby making their project FIPS compliant. To maintain certification, the OpenSSL libraries can't be re-compiled when on a host, but a program's build script that can be adjusted to compile using those libraries, can be classed as compliant. I'm sure you're aware, the distinction between certified and compliant is significant: the former one has to pony up the finances and go through months worth of work, testing and validation; the latter is free and only (?!) requires the work of altering the build script of the project in question.
Describe alternatives you've considered
Are there alternatives to NodeJS? ;) Seriously though, NodeJS has such a solid base and it's reliability is (IMHO) unchallenged, there really isn't another alternative.
For my upper stack of applications I could simply use a newer version of NodeJS, but then they wouldn't be FIPS compliant and that restricts me considerably. I spent months (literally) working through all the versions of NodeJS until I got to the version that could be compiled with the OpenSSL libraries making NodeJS compliant, but AFAIK v8.x was the last version that had this capability. I would love to be told that there's a latter version that can also be used, but I don't believe that to be the case.
FWIW, I'm currently using Ubuntu 16 with the 1.02g OpenSSL libraries but due to the security issues (CVEs etc) I have to look for an alternative. I would love to use Ubuntu 18 and the set of OpenSSL v1.1.1 libraries that Canonical have certified under their Advantage program...
I appreciate the time spent reading through all of this - and keenly look forward to (hopefully good?) news regarding this.
Thank you.