Node --openssl-legacy-provider ERR_OSSL in CI - Fix Digital Envelope Errors

By Kaveh Alemi·Latchkey

Node 17+ uses OpenSSL 3, which dropped a legacy hash older Webpack used. A build fails with ERR_OSSL_EVP_UNSUPPORTED until you upgrade the tooling or opt into the legacy provider.

What this error means

npm run build crashes on Node 17 or newer with error:0308010C:digital envelope routines::unsupported, typically from an older Webpack 4 or create-react-app toolchain.

npm

Error: error:0308010C:digital envelope routines::unsupported
  at new Hash (node:internal/crypto/hash:69:19)
  code: 'ERR_OSSL_EVP_UNSUPPORTED'

Diagnose it: the shell in CI is not your shell

Package scripts run under a different shell, a different PATH, and a non-interactive environment on a runner. Most scripts that fail only in CI are relying on something the login shell gave them locally: a tool on PATH, an environment variable from a dotfile, or a TTY.

Terminal

# what the script can actually see
npm run env | grep -E "^(PATH|NODE_ENV|CI)=" 

# is the binary on PATH for the script, not just for you?
npm exec -- which <tool> || echo "not resolvable from npm scripts"

# run the exact script with tracing
sh -x -c "$(node -p "require('./package.json').scripts.build")"

Common causes

OpenSSL 3 dropped a hash older tooling relies on

Node 17+ ships OpenSSL 3, and old Webpack uses an MD4-based hash that is no longer available by default.

How to fix it

Upgrade the build tooling (preferred)

Upgrade to a Webpack 5 / modern toolchain that uses a supported hash.
This removes the need for the legacy flag entirely.

Set the legacy OpenSSL provider as a stopgap

Set NODE_OPTIONS to enable the legacy provider for the build.
Treat it as temporary until the toolchain is upgraded.

Workflow

env:
  NODE_OPTIONS: --openssl-legacy-provider

Make failures fail the job

A multi-command script can report success while a middle command failed, which produces the worst kind of CI result: a green build that shipped something broken.

.github/workflows/ci.yml

# pipefail is NOT set by default in every runner shell
- name: Build
  shell: bash
  run: |
    set -euo pipefail
    npm run build | tee build.log

How to prevent it

Upgrade build tooling to support OpenSSL 3 and pin the Node version, so you do not depend on a deprecated legacy provider flag long term.

Frequently asked questions

What causes Node --openssl-legacy-provider ERR_OSSL in CI?

openssl 3 dropped a hash older tooling relies on. Node 17+ ships OpenSSL 3, and old Webpack uses an MD4-based hash that is no longer available by default.

How do I fix Node --openssl-legacy-provider ERR_OSSL in CI?

There are 2 fixes depending on which cause you have: upgrade the build tooling (preferred) and set the legacy openssl provider as a stopgap. Work through them in order, since the first is the most common.

What does Node --openssl-legacy-provider ERR_OSSL in CI actually mean?