From 7c00c745505073e85d4a3d27c746fa1a6187031c Mon Sep 17 00:00:00 2001 From: Wade Simmons Date: Wed, 29 Jul 2026 14:37:21 -0400 Subject: [PATCH] complain earlier if in FIPS-140 enforced mode --- pki.go | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/pki.go b/pki.go index 1dc4a68b..0d941b17 100644 --- a/pki.go +++ b/pki.go @@ -337,6 +337,11 @@ func newCertStateFromConfig(c *config.C, cipher string) (*CertState, error) { return nil, err } + if fips140.Enforced() && crt.Curve() != cert.Curve_P256 { + return nil, fmt.Errorf("pki: use of %s is not allowed in FIPS 140-only mode", crt.Curve()) + + } + switch crt.Version() { case cert.Version1: if v1 != nil { @@ -416,7 +421,7 @@ func newCertState(dv cert.Version, v1, v2 cert.Certificate, pkcs11backed bool, p //NOTE: We do not currently have a method to verify a public private key pair when the private key is in an hsm } else { if err := v1.VerifyPrivateKey(privateKeyCurve, privateKey); err != nil { - return nil, fmt.Errorf("private key is not a pair with public key in nebula cert") + return nil, fmt.Errorf("private key is not a pair with public key in nebula cert: %w", err) } } @@ -441,7 +446,7 @@ func newCertState(dv cert.Version, v1, v2 cert.Certificate, pkcs11backed bool, p //NOTE: We do not currently have a method to verify a public private key pair when the private key is in an hsm } else { if err := v2.VerifyPrivateKey(privateKeyCurve, privateKey); err != nil { - return nil, fmt.Errorf("private key is not a pair with public key in nebula cert") + return nil, fmt.Errorf("private key is not a pair with public key in nebula cert: %w", err) } }