Stopped working with Node LTS 18? ("Error: error:0308010C:digital envelope routines::unsupported")

Hello,

when I try to run some code, that uses node-http-ntlm, using the latest Node LTS (currently v18.12.1) it results in an error:

node:internal/crypto/cipher:116
    this[kHandle].initiv(cipher, credential, iv, authTagLength);
                  ^
Error: error:0308010C:digital envelope routines::unsupported
    at Cipheriv.createCipherBase (node:internal/crypto/cipher:116:19)
    at Cipheriv.createCipherWithIV (node:internal/crypto/cipher:135:3)
    at new Cipheriv (node:internal/crypto/cipher:243:3)
    at Object.createCipheriv (node:crypto:141:10)
    at encrypt (C:\folder\node_modules\httpntlm\ntlm.js:265:20)
    at create_LM_hashed_password_v1 (C:\folder\node_modules\httpntlm\ntlm.js:269:27)
    at Object.createType3Message (C:\folder\node_modules\httpntlm\ntlm.js:181:70)
    at sendType3Message (C:\folder\node_modules\httpntlm\httpntlm.js:77:23)
    at Immediate.<anonymous> (C:\folder\node_modules\httpntlm\httpntlm.js:101:4)
    at process.processImmediate (node:internal/timers:471:21) {
  library: 'digital envelope routines',
  reason: 'unsupported',
  code: 'ERR_OSSL_EVP_UNSUPPORTED'
}

Node.js v18.12.1

Running the same code with the previous LTS (v16) I am not experience that issue.

According to [1], it seems to be having to do with some breaking change that happened in node.js v17 related to openssl. A “workaround” apparently is to use “–openssl-legacy-provider” with node or downgrading to v16 - both of which do not feel like a “real solution”.

Is anyone else experiencing the same issue with node v18, or is it just me?

[1] https://stackoverflow.com/questions/69692842/error-message-error0308010cdigital-envelope-routinesunsupported

[skrtheboss]

After some debugging I found, that the problem relies in those two blocks:

https://github.com/SamDecrock/node-http-ntlm/blob/7058d3482a95bdf7f8686653a9e361d6f3abd20d/ntlm.js#L366-L371 https://github.com/SamDecrock/node-http-ntlm/blob/7058d3482a95bdf7f8686653a9e361d6f3abd20d/ntlm.js#L373-L391

One is using md4 and the other DES-ECB which have both been removed in the default provider of OpensslV3, see https://wiki.openssl.org/index.php/OpenSSL_3.0#Providers.

[cjnoname]

We got the same issue here