[padelsbach]

get_params returned 0 for these algs and drops the algs when init'ing the digest/cipher. It also leaves an error in the queue, and a non-blocking app will see SSL_ERROR_SSL and error "OpenSSL Error: error:030000E1:digital envelope routines::cache constants failed" on its first TLS connection.

Fixes zd 22723

[Copilot]

🟡 Changes recommended

FIPS builds that disallow non-FIPS algorithms can still register MD5, MD5-SHA1, and DES3, leaving the cache-constants/error-queue failure unresolved despite skipping the test.

1 open issue

• FIPS builds register non-FIPS algorithms without the required guard · New

What changed in this PR

This PR aims to prevent FIPS algorithm initialization errors in wolfProvider. It adds a FIPS build variant with non-FIPS algorithms enabled and adjusts digest-related checks and tests.

Changes:

• Add configurable wolfSSL build options and a DES3-enabled FIPS Ready CI variant.
• Separate raw ECDSA signing and verification digest minimums, with compatibility fallbacks and updated boundary tests.
• Skip the MD5-SHA1 PRF test when non-FIPS algorithms are disallowed.

File	Description
test/​test_tls1_prf.c	Guard the MD5-SHA1 test in FIPS builds.
test/​test_ecc.c	Test separate signing and verification digest minimums.
src/​wp_ecdsa_sig.c	Apply operation-specific digest minimums.
scripts/​utils-wolfssl.sh	Pass extra wolfSSL configure options.
scripts/​build-wolfprovider.sh	Document the new configure-options variable.
include/​wolfprovider/​internal.h	Centralize digest-minimum compatibility fallbacks.
.github/​workflows/​fips-ready.yml	Add a DES3-enabled variant with a distinct cache key.

_{Review effort: Balanced}

[padelsbach]

Mixed up the commits. See #523