Detailed steps to reproduce the problem?

When an application runs with GODEBUG=fips140=only, opening a TLS connection with certificate verification enabled crashes the process with a panic during OCSP verification.

x/mongo/driver/ocsp/config.go:58 builds the OCSP request with no request options:

cfg.ocspRequestBytes, err = ocsp.CreateRequest(cfg.serverCert, cfg.issuer, nil)

With nil options, golang.org/x/crypto/ocsp.CreateRequest falls back to crypto.SHA1 for the CertID hashes. In FIPS 140-only mode, Go's crypto/sha1 returns an error from Write, which CreateRequest ignores, and panics in Sum:

crypto/sha1: use of SHA-1 is not allowed in FIPS 140-only mode

Call path:

topology.(*connection).connect → configureTLS → ocsp.Verify → ocsp.newConfig → ocsp.CreateRequest → sha1.Sum → panic.

Why this is a bug:

• OCSP verification is meant to soft-fail (no staple, unreachable responders, inconclusive responses), but here it crashes the application instead.
• tlsDisableOCSPEndpointCheck=true doesn't avoid the panic, because newConfig (and so CreateRequest) runs before that option is checked.
• The only workaround is tlsDisableCertificateRevocationCheck=true, which turns revocation checking off entirely.

Affected versions: v2.9.0, v2.9.1, v2.9.2, release/2.9 (df261dcb) and master (b7731a17). The call is unchanged in all of them.

Detailed steps to reproduce the problem

1. Build an application with Go 1.24+ (seen with Go 1.27.x) using go.mongodb.org/mongo-driver/v2 v2.9.x.
2. Point it at a MongoDB deployment that uses TLS with a certificate chain the client can verify. Keep revocation checking at its default (enabled) and don't set tlsInsecure/tlsAllowInvalidCertificates.
3. Run with GODEBUG=fips140=only.
4. Connect and run any command:

package main
import (
      "context"
      "log"
      "time"
      "go.mongodb.org/mongo-driver/v2/mongo"
      "go.mongodb.org/mongo-driver/v2/mongo/options"
)
func main() {
      ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
      defer cancel()
      // TLS-enabled deployment with a verifiable cert chain; revocation checking left at default (enabled)
      client, err := mongo.Connect(options.Client().ApplyURI("mongodb://<host>:27017/?tls=true&tlsCAFile=<ca.pem>"))
      if err != nil {
              log.Fatal(err)
      }
      defer client.Disconnect(ctx)
      if err := client.Ping(ctx, nil); err != nil {
              log.Fatal(err)
      }
      log.Println("ok")
}
$ GODEBUG=fips140=only go run .

Expected: the connection succeeds, or OCSP soft-fails or returns an error, without crashing the process.
Actual: the process panics with crypto/sha1: use of SHA-1 is not allowed in FIPS 140-only mode.

Running the same program with tlsDisableCertificateRevocationCheck=true works, which confirms the panic comes from OCSP.

Definition of done: what must be done to consider the task complete?

The exact Go version used, with patch level:

$ go version

go version go1.27.1

The exact version of the Go driver used:

$ go list -m go.mongodb.org/mongo-driver

<go.mongodb.org/mongo-driver/v2 v2.9.x>

Describe how MongoDB is set up. Local vs Hosted, version, topology, load balanced, etc.

TLS is enabled and the client verifies the server certificate chain.

Any server that presents a verifiable TLS chain should reproduce this. The panic happens on the client, during OCSP request creation, before any OCSP responder is contacted.

The operating system and version (e.g. Windows 7, OSX 10.8, ...)

Base docker image is chainguard-base-fips:v20230214 - Wolfi (Chainguard's rolling-release, apk-based distro)

Security Vulnerabilities

If you've identified a security vulnerability in a driver or any other MongoDB project, please report it according to the instructions here