windows-latest 3.3 case failing with "OpenSSL::Provider::ProviderError: Failed to load legacy provider: (null) (name=legacy)"

[junaruga]

I executed the CI on the current master branch 1fa9fc5 on my forked repository. And I got the following errors on only windows-latest 3.3 case. This failure always happens. And it doesn't happen on other windows-latest X.X cases. I don't know why.

https://github.com/junaruga/ruby-openssl/actions/runs/7477389419/job/20349967549

2) Error: test_openssl_legacy_provider(OpenSSL::TestProvider): OpenSSL::Provider::ProviderError: Failed to load legacy provider: (null) (name=legacy)
D:/a/ruby-openssl/ruby-openssl/test/openssl/test_provider.rb:62:in `load'
D:/a/ruby-openssl/ruby-openssl/test/openssl/test_provider.rb:62:in `<main>'
D:/a/ruby-openssl/ruby-openssl/test/openssl/test_provider.rb:61:in `with_openssl'
D:/a/ruby-openssl/ruby-openssl/test/openssl/test_provider.rb:36:in `test_openssl_legacy_provider'
     33:   end
     34: 
     35:   def test_openssl_legacy_provider
  => 36:     with_openssl(<<-'end;')
     37:       OpenSSL::Provider.load("legacy")
     38:       algo = "RC4"
     39:       data = "a" * 1000

[junaruga]

@MSP-Greg @eregon

In the current latest master, the windows-latest 3.3 case is failing with the error message above. I don't know this issue only happens in the only windows-latest 3.3 but doesn't happen in windows-latest 3.2.

Could you take a look at the issue?

Here is some information about the environments.

windows-latest 3.3:
https://github.com/junaruga/ruby-openssl/actions/runs/7477389419/job/20349967549#step:9:48

ruby 3.3.0 (2023-12-25 revision 5124f9ac75) [x64-mingw-ucrt]
OpenSSL::OPENSSL_VERSION: OpenSSL 3.2.0 23 Nov 2023
OpenSSL::OPENSSL_LIBRARY_VERSION: OpenSSL 3.2.0 23 Nov 2023
OpenSSL::OPENSSL_VERSION_NUMBER: 30200000
OpenSSL::LIBRESSL_VERSION_NUMBER: undefined
FIPS enabled: false
Providers: default

windows-latest 3.2:
https://github.com/junaruga/ruby-openssl/actions/runs/7477389419/job/20349967176#step:9:49

ruby 3.2.2 (2023-03-30 revision e51014f9c0) [x64-mingw-ucrt]
OpenSSL::OPENSSL_VERSION: OpenSSL 3.2.0 23 Nov 2023
OpenSSL::OPENSSL_LIBRARY_VERSION: OpenSSL 3.1.0 14 Mar 2023
OpenSSL::OPENSSL_VERSION_NUMBER: 30200000
OpenSSL::LIBRESSL_VERSION_NUMBER: undefined
FIPS enabled: false
Providers: default

[junaruga]

Here is the code.

openssl/ext/openssl/ossl_provider.c

Lines 62 to 65 in 1fa9fc5

	provider = OSSL_PROVIDER_load(NULL, provider_name_ptr);
	if (provider == NULL) {
	ossl_raise(eProviderError, "Failed to load %s provider", provider_name_ptr);
	}

The manual: OSSL_PROVIDER_load(3)

[eregon]

Please don't @-me for such Windows issues, I have no Windows knowledge and setup-ruby just downloads RubyInstaller2 builds anyway (OTOH MSP-Greg knows a lot more about this stuff).

[junaruga]

Please don't @-me for such Windows issues, I have no Windows knowledge and setup-ruby just downloads RubyInstaller2 builds anyway (OTOH MSP-Greg knows a lot more about this stuff).

OK I will not mention your name for such Windows issues. I was misunderstanding your were familiar with Windows.

[junaruga]

I checked the current master branch's latest CI log that was executed 2 month ago on November 25th 2025. And there was no windows-latest 3.3 case in CI at that time, as Ruby 3.3 was not released yet.
https://github.com/ruby/openssl/actions/runs/6988464298

[junaruga]

I found a cause of this issue, and sent the PR #712.

[MSP-Greg]

@junaruga

First of all, see 97fb4102a19d.

Note that it is only available with ruby/openssl 3.2.0. The first Ruby version containing it was Ruby 3.3. Ruby 3.2 contains ruby/openssl 3.1.0. Whether it will be backported, don't know. Note that re Windows, OpenSSL support is somewhat messy, as both MSY2 and MSFT/vcpkg provide OpenSSL packages, and how they handle 'additional' files is different. Providers file, cert files & dir, etc.

Also, see oneclick/rubyinstaller2#365 (comment). I'm not sure if there has been a Windows 3.3 release with the fix.

Finally, while the PR for the above ruby/openssl commit was 'in process' as a PR, I updated the ruby-loco builds (ucrt, mingw, & mswin) to include the provider files and whatever else was needed.

Greg

[junaruga]

@MSP-Greg Thank you for your comment. It seems we commented at the same time above. I checked the commit partly, and sent and merged a PR to avoid the issue. But I hope the rubyinstaller2 will fix the issue so that we can remove the workaround. I commented on the rubyinstaller2 ticket.