checkId: check.crypto.gost plugin: stellaops.doctor.crypto severity: fail tags: [crypto, gost, russia, compliance]

GOST Algorithm Availability

Doctor check check.crypto.gost — for operators running Stella Ops under Russian regulatory requirements, confirming that the OpenSSL GOST engine is loaded and the GOST signature, hash, and cipher algorithms are available before a deployment relies on them.

What It Checks

Verifies that GOST cryptographic algorithms are available for Russian deployments. The check validates two layers:

Layer 1 - GOST engine detection: Checks whether the OpenSSL GOST engine is loaded by looking for the engine shared object at:

Layer 2 - Algorithm availability (only if engine is loaded): Verifies the following GOST algorithms are accessible:

ConditionResult
GOST engine not loadedFail
Engine loaded but some algorithms missingWarn
Engine loaded and all algorithms availablePass

Evidence collected: CryptoProfile, GostEngineLoaded, AvailableAlgorithms, MissingAlgorithms, RequiredAlgorithms.

The check only runs when Crypto:Profile or Cryptography:Profile contains “gost”, “russia”, or equals “ru”.

Why It Matters

Russian regulatory requirements mandate the use of GOST cryptographic algorithms for government and many commercial deployments. Without GOST algorithm support, the platform cannot create compliant digital signatures or encrypt data according to Russian standards. This blocks deployment in regulated Russian environments and may violate data protection requirements.

Common Causes

How to Fix

Docker Compose

# Check if GOST engine is available
docker compose exec gateway openssl engine gost -c 2>/dev/null || echo "GOST engine not found"

# Install GOST engine in the container (add to Dockerfile for persistence)
# For Debian/Ubuntu based images:
# RUN apt-get install -y libengine-gost-openssl1.1

# Set crypto profile
# Crypto__Profile=ru
# Crypto__Gost__EnginePath=/usr/lib/x86_64-linux-gnu/engines-3/gost.so

docker compose restart gateway

Bare Metal / systemd

# Install GOST engine (Debian/Ubuntu)
sudo apt install libengine-gost-openssl1.1

# Or install from source
git clone https://github.com/gost-engine/engine
cd engine && mkdir build && cd build
cmake .. && make && sudo make install

# Configure OpenSSL to load GOST engine
# Add to /etc/ssl/openssl.cnf:
# [gost_section]
# engine_id = gost
# default_algorithms = ALL

# Verify engine is loaded
openssl engine gost -c

# Activate the Stella Ops GOST compliance profile (writes the user's profile pref)
stella crypto profiles select gost

# Persist the runtime crypto profile in YAML so services pick it up on restart.
# Edit etc/appsettings.crypto.russia.yaml (or the layered appsettings.crypto.yaml
# referenced by your deployment) and ensure it contains:
#   crypto:
#     profile: gost
#     gost:
#       enginePath: /usr/lib/x86_64-linux-gnu/engines-3/gost.so
# Save, then restart the service. The new profile takes effect on the next start.

sudo systemctl restart stellaops-platform

Kubernetes / Helm

# values.yaml
crypto:
  profile: ru
  gost:
    enginePath: /usr/lib/x86_64-linux-gnu/engines-3/gost.so

# Verify in pod
kubectl exec deploy/stellaops-gateway -- openssl engine gost -c

# Use a base image that includes GOST engine support
# Or mount the engine as a volume
helm upgrade stellaops ./charts/stellaops -f values.yaml

Verification

stella doctor run --check check.crypto.gost

See the Doctor reference for the full check catalog, CLI usage, and export bundles.