[Question]: GnuTLS: One of the involved algorithms has insufficient security level.

[mukundhan90]

Product

Amazon Linux 2023

What is your question?

Hi,I recently started using AL2023, and I encountered an issue during a Docker build. When trying to download an artifact from the internal Artifactory using curl or wget, I received the following error related to GnuTLS.

Resolving artifact.intuit.com (artifact.com)... x.x.x.x, x.x.x.x
Caching artifact.com => x.x.x.x,x.x.x.x
Connecting to artifact.com (artifact.com)|x.x.x.x|:443... connected.
Created socket 4.
Releasing 0x0000563dfaad27b0 (new refcount 1).
GnuTLS: One of the involved algorithms has insufficient security level.
Closed fd 4
Unable to establish SSL connection.

Please help with this

[Timidger]

Thank for you report. Is it possible for you to provide us with more details to help you debug this issue further? Could you share your docker file you used to build the artifact? Could you provide detailed steps to reproduce the issue using a url that is internet-facing and accessible?

[mcbrad]

Hey @Timidger I also am running into this same issue. Except it is with wget. This is occurring with podman when trying to do a docker image build with the latest Amazon Linux 2023. We use a slimmed down version of it. But here is the beginning of my Dockerfile that fails.

FROM amazonlinux AS gpg-builder

USER root

RUN dnf install -y gcc14 gcc14-c++ sqlite-devel readline-devel gnutls-devel autoconf automake diffutils gettext make patch bzip2 wget crypto-policies-scripts --nodocs && dnf clean all

ENV CC=/usr/bin/gcc14-cc
ENV CPP=/usr/bin/gcc14-cpp
ENV CXX=/usr/bin/gcc14-g++

# Build libgpg-error (1.58 required for libgcrypt 1.12.0)
RUN cd /tmp && \
    wget http://gnupg.org/ftp/gcrypt/libgpg-error/libgpg-error-1.58.tar.bz2

The wget fails with

Location: https://gnupg.org/ftp/gcrypt/libgpg-error/libgpg-error-1.58.tar.bz2 [following]
--2026-03-04 23:44:47--  https://gnupg.org/ftp/gcrypt/libgpg-error/libgpg-error-1.58.tar.bz2
Connecting to gnupg.org (gnupg.org)|217.69.76.60|:443... connected.
GnuTLS: One of the involved algorithms has insufficient security level.
Unable to establish SSL connection.

This is run through Jenkins on EKS. I am assuming this is due to the EKS containers being FIPS enabled?

Thanks.