notification:test-push --talk fails on FIPS-enabled systems with OpenSSL 3 "illegal or unsupported padding mode"

[anvarkuchkartaev]

Summary

Talk push notification encryption fails on a FIPS-enabled deployment before the push payload is sent.

This does not appear to be related to notify_push.

The push daemon is fully operational, reverse proxy configuration works correctly, and standard push infrastructure is healthy.

The failure happens specifically during payload encryption when running:

sudo -u apache php occ notification:test-push --talk <user-id>

---

Environment

Nextcloud

• Version: 33.0.2.2
• Version string: 33.0.2

Apps

• Notifications: 6.0.0
• Talk: 23.0.3
• notify_push: working correctly

OS

• Oracle Linux 9

PHP

• PHP 8.3.29

OpenSSL

• OpenSSL 3.5.1

OpenSSL 3.5.1 1 Jul 2025
Red Hat Enterprise Linux OpenSSL FIPS Provider

Security posture

• System-wide FIPS enabled
• SELinux: Enforcing
• STIG-aligned hardening

Deployment

• Single node deployment
• Apache
• PHP-FPM
• Redis configured for distributed cache + file locking
• MySQL backend

---

What works

• notify_push daemon starts successfully
• Reverse proxy to /push works
• Standard push infrastructure works
• SELinux issues were resolved separately

This issue occurs after all of the above is functioning correctly.

---

Reproduction

Run:

sudo -u apache php occ notification:test-push --talk <user-id>

---

Actual Result

Testing Talk clients:
Language is set to en
Private user key size: 1704
Public user key size: 451

Found 1 devices registered for push notifications
Identified 1 Talk devices and 0 others.
Trying to push to 1 devices

Device token: 20
Device token is valid
Device public key size: 451
Data to encrypt is:
{"nid":231,"app":"admin_notification_talk","subject":"Testing push notifications","type":"admin_notifications","id":"69f1530a"}

Error while encrypting data:
"error:1C8000A5:Provider routines::illegal or unsupported padding mode"

---

Expected Result

Talk push notifications should either:

1. Work correctly on FIPS-enabled OpenSSL environments

OR

2. Clearly document that current encryption implementation is incompatible with OpenSSL FIPS providers.

---

Additional Notes

This appears to fail during encryption before payload delivery.

The error strongly suggests that the encryption logic is using a padding mode rejected by OpenSSL 3 FIPS providers.

This may affect enterprise/government deployments running hardened Linux environments where FIPS compliance is mandatory.

[nickvergessen]

We are aware of this and working on a solution, but to do it in a less breaking way is quite cumbersome due to the impacted components (various apps (not just notifications), server, mobile and desktop clients, etc.)