For one of my apps I need to enable FIPS for OpenSSL, while simultaneously using software disk encryption.
I launched a CentOS VM instance which was software encrypted during install. The system booted fine (after entering the boot decryption password).
Next, I went through the steps to enable FIPS-OpenSSL and rebooted. The system would not accept my boot decryption password (which was purposely easy to type).
I set up a second VM with an otherwise identical OS/config without software encryption. I enabled FIPS using the steps above, rebooted, and everything works fine with no problems rebooting.
I spun up a third CentOS VM instance, also opting not to use system encryption during installation. After install and basic configuration, I encrypted a test volume using luks, then rebooted. I'm prompted for the password and the system then boots normally.
Next, I enabled FIPS-OpenSSL, rebooted - and get a plethora of errors where I'd usually see the boot password, and the system does not boot.
I booted this VM into single user mode, pulled fips=1 from the kernel line and rebooted. The boot password was accepted this time.
Why is enabling FIPS for OpenSSL causing the boot passwords to fail?