DHE-RSA-AES256-GCM-SHA384 cipher not working on client side

[MS-megliu]

AFD operates as TLS server and uses symcrypt provider, they are seeing below error
Error with DHE cipher on client side (DHE-RSA-AES256-GCM-SHA384):
3613489686336:error:14094438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error:ssl/record/rec_layer_s3.c:1562:SSL alert number 80

To reproduce:
curl -v https://tlsv12-2022.int.protocols.spectest.z01.azfdtest.xyz/ -o /dev/null --resolve tlsv12-2022.int.protocols.spectest.z01.azfdtest.xyz:443:104.209.91.7 --tlsv1.2 --tls-max 1.2 --ciphers DHE-RSA-AES256-GCM-SHA384
or
OPENSSL_TRACE=KEYMGMT,KEYEXCH openssl s_client -connect 172.22.122.133:443 -provider symcryptprovider -cipher DHE-RSA-AES256-GCM-SHA384 -CAfile cert.pem -tls1_2
their server stopped working, need to setup own server.

Root Cause:
The internal error was caused by mix use of openssl default provider and symcryptprovider. The keygen was done by openssl, while keymgmt was done by symcryptoprovider.

(1) symcryptprovider needs to advertise p q g, so openssl knows symcryptprovider support keygen, so after keygen_set_params, the symcrypt keygen will be called.
(2) DHE-RSA-AES256-GCM-SHA384 is not FIPS cipher, so need to add NO_FIPS option when keygen
(3) if OpenSSL passes p, g via params instead of a named group, groupSetByParams == TRUE, but should not block keygen entirely.

Testing:
(1) setup server using: openssl s_server -accept 443 -cert cert.pem -key key.pem -dhparam dhparam.pem -tls1_2 -cipher DHE-RSA-AES256-GCM-SHA384
(2) test with:
OPENSSL_TRACE=KEYMGMT,KEYEXCH openssl s_client -connect 172.22.122.133:443 -provider symcryptprovider -cipher DHE-RSA-AES256-GCM-SHA384 -CAfile cert.pem -tls1_2
and
curl -v https://tlsv12-2022.int.protocols.spectest.z01.azfdtest.xyz/ --resolve tlsv12-2022.int.protocols.spectest.z01.azfdtest.xyz:443:172.22.122.133 --tlsv1.2 --tls-max 1.2 --ciphers DHE-RSA-AES256-GCM-SHA384 --cacert cert.pem -o /dev/null