django FIPS error connecting to postgres

[bgoulet00]

when running nautobot-server migrate for a new deployment i get the following error:

django.db.utils.OperationalError:` connection to server at "myserver.us-gov-east-1.rds.amazonaws.com" (10.x.x.x), port 5432 failed: SSL error: disabled for FIPS
connection to server at "myserver.us-gov-east-1.rds.amazonaws.com" (10.x.x.x), port 5432 failed: FATAL:  no pg_hba.conf entry for host "10.x.x.y", user "nautobot", database "nautobot", no encryption

i then updated nautobot_config.py and added "OPTIONS": {"sslmode": "require"}
now the 'no pg_hba.conf entry for host' error isn't happening anymore but i still get the SSL error: disabled for FIPS

django.db.utils.OperationalError:` connection to server at "myserver.us-gov-east-1.rds.amazonaws.com" (10.x.x.x), port 5432 failed: SSL error: disabled for FIPS

i'm not looking to verify certs or anything, just perform basic encrypted connection to the RDS instance.

i can psql direct to the RDS instance

psql --dbname=nautobot --host=myserver.us-gov-east-1.rds.amazonaws.com --username=nautobot
psql (10.23, server 16.3)
WARNING: psql major version 10, server major version 16.
         Some psql features might not work.
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, bits: 256, compression: off)
Type "help" for help.

nautobot=> 

RHEL 8.10.0, FIPS enabled
Python 3.8.17
Nautobot 2.3.4
AWS RDS Postgresql 16.3, SSL required

i'm a network engineer, not a linux sysad, so please dumb it down for me

[bgoulet00]

in all the output there was another error reported that i missed. the complete error messages without the traceback are the following:

psycopg2.OperationalError: connection to server at "myserver.rds.amazonaws.com" (10.x.x.x), port 5432 failed: SSL error: disabled for FIPS

The above exception was the direct cause of the following exception:

django.db.utils.OperationalError: connection to server at "myserver.rds.amazonaws.com" (10.x.x.x), port 5432 failed: SSL error: disabled for FIPS

[bgoulet00]

the issue was the binary version of psycopg2 is not compatible with systems in FIPS mode. i had to uninstall psycopg2 and then re-install from source code.

[glennmatthews]

Thanks for letting us know. We've talked before about replacing psycopg2-binary with the non-binary version, or at least making it easier to select either variant as an option. This provides some additional weight.