From 419db549eaa44acc5db74d3ca90cc60b868a379e Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Wed, 9 Jul 2025 13:45:59 +0400
Subject: [PATCH] fix: crypto errors and disable acme

---
 backend/src/lib/crypto/cryptography/crypto.ts |  9 +++-----
 backend/src/queue/queue-service.ts            | 23 ++++++++++++++-----
 .../acme/acme-certificate-authority-fns.ts    |  8 ++++++-
 3 files changed, 27 insertions(+), 13 deletions(-)

diff --git a/backend/src/lib/crypto/cryptography/crypto.ts b/backend/src/lib/crypto/cryptography/crypto.ts
index e8111dfed..2fd747ded 100644
--- a/backend/src/lib/crypto/cryptography/crypto.ts
+++ b/backend/src/lib/crypto/cryptography/crypto.ts
@@ -433,12 +433,9 @@ const cryptographyFactory = () => {
       getRandomValues: crypto.getRandomValues,
       randomUUID: crypto.randomUUID,
       subtle: {
-        // eslint-disable-next-line @typescript-eslint/unbound-method
-        generateKey: subtle.generateKey,
-        // eslint-disable-next-line @typescript-eslint/unbound-method
-        importKey: subtle.importKey,
-        // eslint-disable-next-line @typescript-eslint/unbound-method
-        exportKey: subtle.exportKey
+        generateKey: subtle.generateKey.bind(subtle),
+        importKey: subtle.importKey.bind(subtle),
+        exportKey: subtle.exportKey.bind(subtle)
       },
       constants: crypto.constants,
       X509Certificate: crypto.X509Certificate,
diff --git a/backend/src/queue/queue-service.ts b/backend/src/queue/queue-service.ts
index 2761179a8..9f4d1c67f 100644
--- a/backend/src/queue/queue-service.ts
+++ b/backend/src/queue/queue-service.ts
@@ -18,6 +18,7 @@ import {
 } from "@app/ee/services/secret-scanning-v2/secret-scanning-v2-types";
 import { getConfig } from "@app/lib/config/env";
 import { buildRedisFromConfig, TRedisConfigKeys } from "@app/lib/config/redis";
+import { crypto } from "@app/lib/crypto";
 import { logger } from "@app/lib/logger";
 import { QueueWorkerProfile } from "@app/lib/types";
 import { CaType } from "@app/services/certificate-authority/certificate-authority-enums";
@@ -438,9 +439,14 @@ export const queueServiceFactory = (
 
     queueContainer[name] = new Queue(name as string, {
       ...queueSettings,
-      settings: {
-        repeatKeyHashAlgorithm: "sha256"
-      },
+      ...(crypto.isFipsModeEnabled()
+        ? {
+            settings: {
+              ...queueSettings?.settings,
+              repeatKeyHashAlgorithm: "sha256"
+            }
+          }
+        : {}),
       connection
     });
 
@@ -448,9 +454,14 @@ export const queueServiceFactory = (
     if (appCfg.QUEUE_WORKERS_ENABLED && isQueueEnabled(name)) {
       workerContainer[name] = new Worker(name, jobFn, {
         ...queueSettings,
-        settings: {
-          repeatKeyHashAlgorithm: "sha256"
-        },
+        ...(crypto.isFipsModeEnabled()
+          ? {
+              settings: {
+                ...queueSettings?.settings,
+                repeatKeyHashAlgorithm: "sha256"
+              }
+            }
+          : {}),
         connection
       });
     }
diff --git a/backend/src/services/certificate-authority/acme/acme-certificate-authority-fns.ts b/backend/src/services/certificate-authority/acme/acme-certificate-authority-fns.ts
index 46a55821d..d7893779c 100644
--- a/backend/src/services/certificate-authority/acme/acme-certificate-authority-fns.ts
+++ b/backend/src/services/certificate-authority/acme/acme-certificate-authority-fns.ts
@@ -5,7 +5,7 @@ import acme from "acme-client";
 import { TableName } from "@app/db/schemas";
 import { CustomAWSHasher } from "@app/lib/aws/hashing";
 import { crypto } from "@app/lib/crypto/cryptography";
-import { BadRequestError, NotFoundError } from "@app/lib/errors";
+import { BadRequestError, CryptographyError, NotFoundError } from "@app/lib/errors";
 import { OrgServiceActor } from "@app/lib/types";
 import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
 import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
@@ -190,6 +190,12 @@ export const AcmeCertificateAuthorityFns = ({
     enableDirectIssuance: boolean;
     actor: OrgServiceActor;
   }) => {
+    if (crypto.isFipsModeEnabled()) {
+      throw new CryptographyError({
+        message: "ACME is currently not supported in FIPS mode of operation."
+      });
+    }
+
     const { dnsAppConnectionId, directoryUrl, accountEmail, dnsProviderConfig } = configuration;
     const appConnection = await appConnectionDAL.findById(dnsAppConnectionId);