[Feature] Upgrade to OpenSSL 3.x and support FIPS 140-3 deployments
Search before asking
- I had searched in the issues and found no similar issues.
Description
Background
Apache Doris currently pins OpenSSL 1.1.1s in thirdparty/vars.sh.
OpenSSL 1.1.1 has reached upstream end of life. Organizations operating in regulated environments also increasingly require cryptographic operations to use FIPS 140-3 validated cryptographic modules.
Requested Changes
- Upgrade the Doris OpenSSL dependency from OpenSSL 1.1.1s to a supported OpenSSL 3.x release.
- Support building and running Doris with an OpenSSL 3 FIPS Provider.
- Provide a configuration allowing operators to require FIPS-approved cryptographic implementations.
- Identify and document Doris components and third-party libraries that perform cryptographic operations.
- Ensure dependencies do not silently bypass the configured FIPS provider.
- Document the process for deploying Doris in an operating system configured for FIPS operation.
Motivation
This is required for organizations deploying Apache Doris in regulated environments.
Supporting OpenSSL 3.x would also remove dependency on the upstream EOL OpenSSL 1.1.1 branch.
Current Dependency
The current master branch contains:
OPENSSL_DOWNLOAD="https://github.com/openssl/openssl/archive/OpenSSL_1_1_1s.tar.gz"
Proposed Architecture
A supported configuration should allow:
Apache Doris → OpenSSL 3.x → FIPS Provider → FIPS 140-3 validated cryptographic module
Doris should either load only the appropriate providers or support OpenSSL configuration that enforces use of FIPS-approved algorithms.
Acceptance Criteria
- Doris successfully builds against supported OpenSSL 3.x.
- Existing TLS functionality passes regression testing.
- FE-to-BE and BE-to-BE TLS operates correctly.
- External HTTPS/TLS integrations operate correctly.
- Doris can operate using an OpenSSL FIPS Provider.
- Non-FIPS algorithms can be prevented from being selected in FIPS mode.
- Relevant third-party dependencies are tested for OpenSSL 3.x compatibility.
- Documentation describes configuration and verification of the FIPS deployment.
- CI continuously tests OpenSSL 3 compatibility.
Use case
This is required for organizations deploying Apache Doris in regulated environments.
Supporting OpenSSL 3.x would also remove dependency on the upstream EOL OpenSSL 1.1.1 branch.
Related issues
Supporting OpenSSL 3.x would also remove dependency on the upstream EOL OpenSSL 1.1.1 branch.
The current master branch contains:
OPENSSL_DOWNLOAD="https://github.com/openssl/openssl/archive/OpenSSL_1_1_1s.tar.gz"
Are you willing to submit PR?
- Yes I am willing to submit a PR!
Code of Conduct
- I agree to follow this project's Code of Conduct
Source: apache/doris