Issue

The test test_integration/test_caless.py::TestIPACommands fails in FIPS mode in a step trying to create a PKCS12 file from a key+pem file.

Steps to Reproduce

In FIPS mode, call openssl pkcs12 -export -out server.p12 -inkey server.key -in server.pem -passin pass:Secret.123 -passout pass:Secret.123 -name ca1/server

Actual behavior

Error creating PKCS12 MAC; no PKCS12KDF support?
Use -nomac if MAC not required and PKCS12KDF support not available.
00AEB869387F0000:error:05800074:x509 certificate routines:X509_check_private_key:key values mismatch:crypto/x509/x509_cmp.c:405:
00AEB869387F0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:crypto/evp/evp_fetch.c:341:Global default library context, Algorithm (PKCS12KDF : 179), Properties (<null>)
00AEB869387F0000:error:1180006B:PKCS12 routines:pkcs12_gen_mac:key gen error:crypto/pkcs12/p12_mutl.c:147:
00AEB869387F0000:error:1180006D:PKCS12 routines:PKCS12_set_mac:mac generation error:crypto/pkcs12/p12_mutl.c:220:

Expected behavior

The test should successfully create the PKCS12 file.

The PKCS12 MAC requires PKCS12KDF which is not an approved FIPS algorithm and cannot be supported by the FIPS provider.
The test should not require mac verification in FIPS mode: append the option -nomac to the command openssl pkcs12 used to create the pkcs12 file.

Versions

fedora 39
openssl-1:3.1.1-4.fc39.x86_64