This is the story of how Canonical’s Support team provided bug-fix support: we tracked down an upstream change in OpenSC that inadvertently broke FIPS compatibility, coordinated with upstream developers across distributions, and delivered both a hotfix and a proper universal solution. […]

The Ubuntu Blog provides updates, tutorials, and insights on the Ubuntu operating system and related projects. Covering topics such as Linux desktops, server administration, and cloud computing, the blog offers resources for developers and sysadmins working with Ubuntu. Developers can learn how to set up, configure, and optimize Ubuntu systems for development, deployment, and production environments by following the Ubuntu Blog.

Ubuntu

A government agency's smartcard authentication broke when enabling FIPS mode on Ubuntu 24.04 LTS. Canonical's support team traced the issue to an upstream OpenSC change that incorrectly initialized the OpenSSL provider, using the default provider instead of the FIPS provider. The team delivered a hotfix to unblock the customer's 1,000-system rollout while coordinating with upstream maintainers on a universal solution. The fix addresses how OpenSC handles provider initialization when OpenSSL returns NULL for FIPS-disallowed algorithms.

When an upstream change broke smartcard FIPS authentication – and how we fixed it

The investigation: confirming the root cause

The key ingredient: collaboration across the ecosystem

Learn more about bug-fix support through Ubuntu Pro + Support