Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running SCEP client to enroll certificates on NDES server. If OpenSSL is not in FIPS mode - everything works fine.

In FIPS mode i get the following error:

pkcs7_unwrap():pkcs7.c:708] error decrypting inner PKCS#7
139968442623728:error:060A60A3:digital envelope routines:FIPS_CIPHERINIT:disabled for fips:fips_enc.c:142:
139968442623728:error:21072077:PKCS7 routines:PKCS7_decrypt:decrypt error:pk7_smime.c:557:

That's because NDES server uses DES algorithm to encrypt returned PKCS#7 packet. I used the following debug code:

/* Copy enveloped data from PKCS#7 */
    bytes = BIO_read(pkcs7bio, buffer, sizeof(buffer));
    BIO_write(outbio, buffer, bytes);

    p7enc = d2i_PKCS7_bio(outbio, NULL);

/* Get encryption  PKCS#7 algorithm */

    printf("evp_cipher->nid = %d\n", evp_cipher->nid);

The last string always prints:

evp_cipher->nid = 31

defined in openssl-1.0.1c/include/openssl/objects.h

#define SN_des_cbc "DES-CBC"
#define LN_des_cbc "des-cbc"
#define NID_des_cbc 31

I use 3DES algorithm for PKCS7 requests encryption in my code (pscep.enc_alg = (EVP_CIPHER *)EVP_des_ede3_cbc()) and NDES server accepts these requests, but it always returns answer encrypted with DES.

Can I configure Wndows NDES server to use Triple DES (3DES) algorithm for PKCS#7 answer encryption?

share|improve this question
up vote 0 down vote accepted

I got answer from Microsoft support (Diana Zhang) saying this is impossible:

After in-depth research, want to let you know:
The content encryption algorithm for P7 in hardcoded to DES(in CBC mode).
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.