FIPS Error: FATAL FIPS SELF TEST on startup

[bblease]

I'm getting the error:

crypto/fips/fips.c:154: OpenSSL internal error: FATAL FIPS SELFTEST FAILURE

when starting docling-serve's docker container. The other issues listed here seem to indicate they've received this error on an API call, rather than startup.

Using verbose mode, the final line before reaching this error is:

INFO:docling.models.factories:Registered picture descriptions: ['picture_description_vlm_engine', 'vlm', 'api']

[dosubot]

Hi @bblease! I'm Dosu and I’m helping the docling-serve team.

This FIPS error is a known issue caused by two factors:

1. EasyOCR uses hashlib.md5() without usedforsecurity=False for model file verification, which fails on FIPS-enabled systems
2. The av package v15.x+ breaks FIPS compatibility

Recommended fix: Switch to Tesseract or RapidOCR, which are FIPS-compliant:

{
  "options": {
    "ocr_engine": "tesseract",
    "do_ocr": true
  }
}

Workaround if you need EasyOCR: Create an init script as your container entrypoint:

#!/bin/bash
sed -i 's/hash_md5 = hashlib.md5()/hash_md5 = hashlib.md5(usedforsecurity=False)/' /opt/app-root/lib/python3.12/site-packages/easyocr/utils.py
pip install --force-reinstall -v "av==14.4.0"
docling-serve run

Note that EasyOCR is no longer the default OCR engine and is no longer actively maintained by the docling-serve team.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[bblease]

This is unfortunately not relevant because docling never initializes the API endpoints.

[dosubot]

The cryptography package isn't the culprit here—it's a transitive dependency through google-auth and PyJWT and not directly imported by docling-serve.

The known causes of this FIPS error are:

1. EasyOCR - uses hashlib.md5() without usedforsecurity=False for model verification
2. av package v15.x+ - has FIPS compatibility issues

Since your last log line shows "Registered picture descriptions", the crash happens during model warm-up/initialization when these dependencies get loaded.

To diagnose further:

• Check if EasyOCR is being loaded: pip list | grep -i easyocr
• Check av version: pip show av

To fix:

# Patch EasyOCR
sed -i 's/hash_md5 = hashlib.md5()/hash_md5 = hashlib.md5(usedforsecurity=False)/' /opt/app-root/lib/python3.12/site-packages/easyocr/utils.py

# Downgrade av
pip install --force-reinstall -v "av==14.4.0"

Or switch to a FIPS-compliant OCR engine like Tesseract/RapidOCR to avoid loading EasyOCR entirely.

What base image are you building from? GPU images tend to have FIPS-enforcing OpenSSL, while CPU images often don't.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[fantamanatee]

The error is still unresolved. If anyone has found a workaround, please share.

I have tried installing av==14.0.1 and ab==16.0.1.

pip install --force-reinstall av==
I am unable to build av from source using -v because that requires ffmpeg.

I have implemented the hashlib patch as suggested in 377.

[bd-mkt]

I have a working fork here fips fork. The fix that isn't mentioned above is that both opencv-python and opencv-python-headles need to be locked to version 4.12.0.88. Versions above that have fips problems I haven't had the time/desire to dig into. Both of these need to be set as dependent libraries use both and they will step on each other.

[bblease]

OpenCV is indeed the issue and can also be version locked in a custom Dockerfile using docling-serve as the base image.