Bundled FIPS-mode OpenSSL in native extensions SIGSEGVs on any host that exports OPENSSL_FORCE_FIPS_MODE (even =0)

[a-niehaus]

Description

Summary

Isaac Sim 6.0.0.1 (pip install, headless) crashes during SimulationApp startup with a fatal OpenSSL FIPS self-test failure whenever the environment contains OPENSSL_FORCE_FIPS_MODE — regardless of its value. The bundled OpenSSL inside several native extension .so files appears to treat the variable's presence as "enable FIPS" and ignores the 0 value, then aborts on a self-test against its statically linked libcrypto.

Repro

1. On a host where OPENSSL_FORCE_FIPS_MODE=0 is exported (e.g. Databricks Runtime sets this in-container; on a plain machine, export OPENSSL_FORCE_FIPS_MODE=0), pip-install Isaac Sim 6.0.0.1.
2. Run:

   from isaacsim import SimulationApp
   app = SimulationApp({"headless": True, "renderer": "RaytracedLighting"})
   app.update()
   app.close()

Result

SIGSEGV (~15–25s in) while loading native extensions (first observed at isaacsim.robot.experimental.wheeled_robots, then omni.sensors.nv.*):

crypto/fips/fips.c:154: OpenSSL internal error: FATAL FIPS SELFTEST FAILURE

Excluding the first offending extension just moves the abort to the next FIPS-bundled .so.

The host is not in FIPS mode: /proc/sys/crypto/fips_enabled is absent and system OpenSSL is 3.0.13 (non-FIPS). The failing FIPS module is the one statically bundled inside the extension binaries, not the system OpenSSL.

Workaround

Unsetting the variable entirely before launch fixes it:

env -u OPENSSL_FORCE_FIPS_MODE python script.py

Setting it to 0 does not work; only full removal does.

Ineffective mitigations (for completeness): OPENSSL_CONF=/dev/null, a minimal default-provider openssl.cnf, OPENSSL_FIPS=0, unsetting OPENSSL_MODULES, and LD_PRELOAD of the system non-FIPS libcrypto.

Ask

The extensions should not ship a FIPS-mode OpenSSL that aborts on hosts merely exporting OPENSSL_FORCE_FIPS_MODE, and ideally should honor =0 as "do not enable FIPS." This breaks Isaac Sim out of the box on container platforms (e.g. Databricks) that set this variable.

Isaac Sim version

6.0.0.1

Operating System (OS)

Ubuntu 24.04

GPU Name

NVIDIA A10G

GPU Driver and CUDA versions

Driver 580.126.09, CUDA 13.0

Logs

2026-06-12T11:36:01Z [Info] [carb] Logging to file: /local_disk0/.ephemeral_nfs/envs/pythonEnv-b4c6302f-db77-4427-8b19-ae4801eef313/lib/python3.12/site-packages/isaacsim/kit/logs/Kit/Isaac-Sim Python/6.0/kit_20260612_113601.log
[0.683s] [ext: omni.gpu_foundation.shadercache.vulkan-1.0.0] startup
[0.706s] [ext: omni.gpu_foundation-0.0.0] startup
[1.162s] [ext: omni.kit.renderer.init-1.0.1] startup
| Driver Version: 580.126.09 | Graphics API: Vulkan
| GPU | Name | Active | LDA | GPU Memory | Vendor-ID | LUID |
| | | | | | Device-ID | UUID |
2026-06-12T11:36:05Z [4,024ms] [Warning] [omni.rtx] ECC is enabled on physical device 0
2026-06-12T11:36:05Z [4,025ms] [Warning] [omni.rtx] PCIe link width current (8) and maximum (16) for device 0 don't match.
[4.793s] [ext: omni.gpucompute.plugins-0.0.0] startup
[5.690s] [ext: omni.kit.renderer.core-1.2.2] startup
2026-06-12T11:36:07Z [5,906ms] [Warning] [carb] Failed to startup plugin carb.windowing-glfw.plugin (interfaces: [carb::windowing::IGLContext v1.0],[carb::windowing::IWindowing v1.5]) (impl: carb.windowing-glfw.plugin)
[6.038s] [ext: omni.kit.renderer.capture-2.0.1] startup
[6.045s] [ext: omni.kit.renderer.imgui-2.0.6] startup
2026-06-12T11:36:07Z [5,958ms] [Warning] [carb] Failed to startup plugin carb.windowing-glfw.plugin (interfaces: [carb::windowing::IGLContext v1.0],[carb::windowing::IWindowing v1.5]) (impl: carb.windowing-glfw.plugin)
2026-06-12T11:36:07Z [5,962ms] [Warning] [carb] Failed to startup plugin carb.windowing-glfw.plugin (interfaces: [carb::windowing::IGLContext v1.0],[carb::windowing::IWindowing v1.5]) (impl: carb.windowing-glfw.plugin)
[6.574s] [ext: omni.kit.audiodeviceenum-1.0.2] startup
[6.980s] [ext: omni.usd.schema.render_settings.rtx-1.0.2] startup
[7.184s] [ext: omni.physx.gpu-110.1.11] startup
[7.185s] [ext: omni.physx.foundation-110.1.11] startup
[16.656s] [ext: omni.hydra.rtx.shadercache.vulkan-1.0.0] startup
[16.693s] [ext: omni.hydra.rtx-1.0.3] startup
[19.543s] [ext: isaacsim.robot.experimental.wheeled_robocrypto/fips/fips.c:154: OpenSSL internal error: FATAL FIPS SELFTEST FAILURE
[20.164s] [ext: isaacsim.sensors.experimental.rtx-1.4.3] startup
Driver Version : 580.126.09
CUDA Version : 13.0
Attached GPUs : 1
GPU 00000000:00:1E.0
Driver Model
GPU UUID : GPU-0eb1e302-f661-d710-2844-84f3d0a84b9e
GPU PDI : 0xe2ec65006b3afd0d
MultiGPU Board : No
GPU Part Number : 2237-892-A1
GPU Fabric GUID : N/A
GPU Operation Mode
GPU C2C Mode : N/A
GPU Virtualization Mode
Host VGPU Mode : N/A
vGPU Heterogeneous Mode : N/A
GPU Recovery Action : None
Device : 0x1E
Device Id : 0x223710DE
GPU Link Info
Device Current : 1
Device Max : 4
GPU : 0 %
ECC Errors
Correctable Error : 0
Uncorrectable Error : 0
GPU Current Temp : 30 C
GPU T.Limit Temp : N/A
GPU Shutdown Temp : 98 C
GPU Slowdown Temp : 95 C
GPU Max Operating Temp : 88 C
GPU Target Temperature : N/A
GPU Power Readings
GPU Memory Power Readings
| Driver Version: 580.126.09 | Graphics API: Vulkan
| GPU | Name | Active | LDA | GPU Memory | Vendor-ID | LUID |
| | | | | | Device-ID | UUID |
----- FIRST 40 LINES -----
WARNING: All log messages before absl::InitializeLog() is called are written to STDERR
E0000 00:00:1781264161.836644 4784 descriptor_database.cc:633] File already exists in database: grpc/health/v1/health.proto
W0000 00:00:1781264161.836922 4784 message.cc:301] Protobuf GeneratedMessageFactory: File is already registered: grpc/health/v1/health.proto
2026-06-12T11:36:01Z [Info] [carb] Logging to file: /local_disk0/.ephemeral_nfs/envs/pythonEnv-b4c6302f-db77-4427-8b19-ae4801eef313/lib/python3.12/site-packages/isaacsim/kit/logs/Kit/Isaac-Sim Python/6.0/kit_20260612_113601.log
[0.260s] [ext: omni.assets.plugins-0.0.0] startup
[0.266s] [ext: omni.blobkey-1.1.2] startup
[0.267s] [ext: omni.kit.async_engine-0.0.3] startup
[0.570s] [ext: omni.client.lib-1.1.1] startup
[0.623s] [ext: omni.client-1.3.0] startup
[0.646s] [ext: omni.protobuf.lib-1.0.0] startup
[0.655s] [ext: omni.grpc.lib-1.0.0] startup
[0.678s] [ext: omni.metrics.core-0.0.3] startup
[0.679s] [ext: omni.datastore-0.0.0] startup
[0.683s] [ext: omni.gpu_foundation.shadercache.vulkan-1.0.0] startup
[0.691s] [ext: omni.hsscclient-1.1.4] startup
[0.694s] [ext: omni.stats-1.0.1] startup
[0.697s] [ext: omni.ujitso.default-1.0.0] startup
[0.706s] [ext: omni.gpu_foundation-0.0.0] startup
[1.159s] [ext: carb.windowing.plugins-1.0.1] startup
[1.162s] [ext: omni.kit.renderer.init-1.0.1] startup
2026-06-12T11:36:02Z [1,209ms] [Warning] [omni.platforminfo.plugin] failed to open the default display. Can't verify X Server version.

|---------------------------------------------------------------------------------------------|
| Driver Version: 580.126.09 | Graphics API: Vulkan
|=============================================================================================|
| GPU | Name | Active | LDA | GPU Memory | Vendor-ID | LUID |
| | | | | | Device-ID | UUID |
| | | | | | Bus-ID | |
|---------------------------------------------------------------------------------------------|
| 0 | NVIDIA A10G | Yes: 0 | | 23028 MB | 10de | 0 |
| | | | | | 2237 | 0eb1e302.. |
| | | | | | 0 | |
|=============================================================================================|
| OS: 24.04.4 LTS (Noble Numbat) ubuntu, Version: 24.04.4, Kernel: 5.15.0-1106-aws
| Processor: AMD EPYC 7R32
| Cores: 2 | Logical Cores: 4
|---------------------------------------------------------------------------------------------|
| Total Memory (MB): 11093 | Free Memory: 1323
| Total Page/Swap (MB): 10239 | Free Page/Swap: 17592186044415
|---------------------------------------------------------------------------------------------|
7273

Additional information

No response

[vick-yu]

Thanks for the detailed report and for narrowing it down to OPENSSL_FORCE_FIPS_MODE -- that saves a lot of back-and-forth.

What's Happening

The crash is coming from the OpenSSL 1.1.1k FIPS library that ships inside the bundled opencv-python-headless package (v4.13.0.90). Specifically, the file opencv_python_headless.libs/libcrypto-3dc39733.so.1.1.1k is an OpenSSL 1.1.1k build compiled with FIPS support.

In OpenSSL 1.1.1 FIPS builds, the OPENSSL_FORCE_FIPS_MODE environment variable is checked via getenv() during library initialization -- the mere presence of the variable triggers FIPS_mode_set(1), regardless of whether the value is 0, false, or empty. Once FIPS mode is enabled, the library runs a mandatory self-test against its statically linked FIPS module. That self-test fails because the redistributed binary's integrity hash doesn't match what the FIPS module expects (this is by design in FIPS 140-2 -- the self-test is tied to the exact build artifact).

This is a known upstream issue in opencv-python: opencv/opencv-python#1184. Databricks and similar container runtimes set OPENSSL_FORCE_FIPS_MODE=0 globally, which triggers the crash in any process that loads the bundled OpenCV.

Multiple Isaac Sim extensions depend on omni.pip.compute (which bundles OpenCV), so the crash can surface during the startup of whichever extension loads cv2 first -- explaining why excluding one extension just moves the abort to the next.

Workaround

Your workaround of unsetting the variable is correct and is the most reliable fix on the user side:

env -u OPENSSL_FORCE_FIPS_MODE python your_script.py

Or in a wrapper script / Databricks init script:

unset OPENSSL_FORCE_FIPS_MODE
exec python your_script.py

If you're in a Databricks notebook, you can unset it before importing Isaac Sim:

import os
os.environ.pop("OPENSSL_FORCE_FIPS_MODE", None)

from isaacsim import SimulationApp
# ...

Important: This must happen before any Isaac Sim import, since the native library initialization occurs at import time.

We'll review this internally and reach out with any updates.

[vick-yu]

Our team is developing a fix for this issue, and the solution could be included in version 6.0.1.