Remove OpenSSL FIPS configuration from the FIPS build image (#64591)

PR #34950 put OpenSSL into FIPS mode in the _build container_,
which causes any build tooling that relies on OpenSSL to use FIPS
crypto.

A result of that change is that we can no longer update our Rust
toolchain. The `cargo` utility shipped with Rust versions newer
than 1.86 depends on a newer version of OpenSSL, and when this
version runs in FIPS mode cargo itself is not able to fetch dependencies
from the public registry due to incompatible cipher suites.

Note: our build artifacts are still compiled against FIPS-validated
modules (Go's GOEXPERIMENT=boring, and Cloudflare's boring crate for
Rust).

Makefile

@@ -86,8 +86,7 @@ FIPS_TAG := fips
 FIPS_MESSAGE := with-FIPS-support
 RELEASE = teleport-$(GITTAG)-$(OS)-$(ARCH)-fips-bin
 GOEXPERIMENT = boringcrypto
-OPENSSL_FIPS = 1
-export GOEXPERIMENT OPENSSL_FIPS
+export GOEXPERIMENT
 ifeq ($(BUILDBOX_MODE),cross)
 # We need to set CGO_ENABLED=0 when building rdpclient as the build of
 # boring-sys builds and runs a Go program as part of its integrity testing.

build.assets/Dockerfile-centos7

@@ -317,7 +317,7 @@ EXPOSE 6600 2379 2380
 
 ## BUILDBOX-FIPS ##############################################################
 # Build the `buildbox-fips` target to create a buildbox that creates a FIPS
-# Teleport binary. It enables FIPS in the Go toolchain and in OpenSSL, and
+# Teleport binary. It enables FIPS in the Go toolchain and
 # builds a test binary to ensure binaries are FIPS-compliant.
 
 FROM buildbox as buildbox-fips
@@ -325,21 +325,12 @@ FROM buildbox as buildbox-fips
 # Set environment variables used for enabling FIPS mode
 # `GOEXPERIMENT=boringcrypto` -- enable FIPS mode (BoringCrypto) for Go
 # https://github.com/golang/go/blob/master/src/crypto/internal/boring/README.md
-# `OPENSSL_FIPS=1` -- enable FIPS mode for OpenSSL
-# https://www.openssl.org/docs/man3.0/man7/fips_module.html
-ENV GOEXPERIMENT=boringcrypto \
-    OPENSSL_FIPS=1
-
-# Enable OpenSSL FIPS mode by default
-# https://www.openssl.org/docs/man3.0/man7/fips_module.html
-COPY fips-files/openssh.cnf /usr/local/ssl/openssl.cnf
+ENV GOEXPERIMENT=boringcrypto
 
 USER ci
 
 # Validate that environment variables were set
-RUN echo "Ensure environment variables are set" && \
-    [ -n "$GOEXPERIMENT" ] && \
-    [ -n "$OPENSSL_FIPS" ]
+RUN echo "Ensure environment variables are set" && [ -n "$GOEXPERIMENT" ]
 
 # Validate that Go binaries have BoringCrypto enabled
 COPY --chown=ci fips-files/boringtest.nogo /tmp/boringtest.go
@@ -347,10 +338,5 @@ COPY --chown=ci fips-files/boringtest.nogo /tmp/boringtest.go
 RUN echo "Ensure Go is using BoringCrypto" && \
     go run /tmp/boringtest.go
 
-RUN echo "Ensure OpenSSL is using FIPS module" && \
-    ! openssl md5 /tmp/boringtest.go > /dev/null 2>&1
-
-RUN rm /tmp/boringtest.go
-
 VOLUME ["/go/src/github.com/gravitational/teleport"]
 EXPOSE 6600 2379 2380

build.assets/fips-files/openssh.cnf

@@ -1,14 +0,0 @@
-config_diagnostics = 1
-openssl_conf = openssl_init
-
-.include /usr/local/ssl/fipsmodule.cnf
-
-[openssl_init]
-providers = provider_sect
-
-[provider_sect]
-fips = fips_sect
-base = base_sect
-
-[base_sect]
-activate = 1