How to Fix Error 0308010C Digital Envelope Routines Unsupported

You may see an error:0308010C:digital envelope routines::unsupported message when a tool that uses OpenSSL 3, such as Homebrew's openssl command or Node.js 17 and later, needs an algorithm OpenSSL 3 no longer loads by default. macOS's own /usr/bin/openssl is LibreSSL, which doesn't show this error.

Starting with OpenSSL 3.0, OpenSSL introduces some significant changes to its algorithms, moving older algorithms such as MD4 and RC2 into OpenSSL 3.0's legacy provider. A provider in OpenSSL is a collection of algorithms that can be added to an application when required. The legacy provider contains algorithms that are considered outdated and less secure, and it does not load by default.


The simplest way to resolve this error is to modify your command to bring back support for legacy algorithms.

FIX ERROR 0308010C

Step One

In this example, we'll use the openssl pkcs12 command to parse a PKCS#12 file to a PEM file on macOS Sonoma with Homebrew's OpenSSL 3.1.4.

example:
openssl pkcs12 -in apns.p12 -out apns.pem -nodes



This throws the following error:


Error outputting keys and certificates
409CEAE301000000 :error:0308010C:digital envelope routines:inner_evp_generic_ fetch: unsupported:crypto/evp/evp_fetch.c:341:Global default library context, Algorithm (RC2-40-CBC : 0), Properties ()

Step Two

To resolve the error, you can bring back support for legacy algorithms in openssl using the -legacy option.

example:
openssl pkcs12 -in apns.p12 -out apns.pem -nodes -legacy

PERMANENT FIX

You can permanently have OpenSSL load legacy providers if required. Here's how.

Step One
Check to see which providers are loaded using the following command...

openssl list -providers




Step Two
Find the directory in which your openssl configuration file is located...

openssl version -d



Step Three
Open the configuration file for editing, using the directory information found in the previous command. Enter your administrative password if prompted.

sudo nano /opt/homebrew/etc/openssl@3/openssl.cnf




Step Four
Under the [provider_sect] add the following line:

legacy = legacy_sect




Step Five
Under the [default_sect] uncomment the "activate = 1" line by removing the # symbol

[default_sect]
activate = 1




Step Six
Below that, add the following the new section

[legacy_sect]
activate = 1




Step Seven
Press Control+X to exit the file, then press Y to save your changes.



Hit Return to confirm the file name to write.




Step Eight
You can now verify that legacy providers are loaded with the following command:

openssl list -providers




Step Nine
Finally, try your initial command again to verify that error:0308010C:digital envelope routines unsupported is gone.

FIX ERROR 0308010C IN NODE.JS

Node.js 17 and later use OpenSSL 3. If a build tool such as webpack or react-scripts stops with this error, it is asking for an algorithm OpenSSL 3 no longer allows by default. The lasting fix is to update the project's build tools. Node.js also offers a temporary workaround that loads the legacy provider: run your command with

NODE_OPTIONS=--openssl-legacy-provider npm run build

replacing npm run build with the command that showed the error.