added default provider and that seemed to fix the issue. pertinent sections from /etc/ssl/openssl.cnf:
``` [openssl_init] providers = provider_sect
[provider_sect] default = default_sect ```
thanks for pointing out that related issue @space88man I think this version of openssl.cnf is packaged by debian since the openssl repo has the default provider enabled by default: https://github.com/openssl/openssl/blob/openssl-3.0/apps/openssl.cnf#L53