To configure the JRE for BCFIPS approved-only mode:
Add the BCFIPS.jar files to the Java classpath.
The required BCFIPS files are as follows:
bc-fips-1.0.2.4.jar
bcpkix-fips-1.0.7.jar
bctls-fips-1.0.18.jar
Modify the java.security file in the <jre-root>/conf/security directory and set a BCFIPS-defined Java system property.
In a text editor, open the above file for the JRE that is hosting the web container at <jre-root>/conf/security/java.security. Find the list of security providers, comment on all the existing providers, and replace the entries with the following:
security.provider.1=BCFIPS
security.provider.2=BCJSSE
security.provider.3=SunJSSE
security.provider.4=SUN
security.provider.5=SunJCE
The SunJSSE provider (Java 11) is required because OSP requires specific TrustManager implementations when initializing its truststores. In addition to the changes to the security providers, the BCFIPS JSSE KeyManager implementation must be used. This is necessary mostly because deficiencies in the Sun implementation does not allow certain FIPS-required determinations about keys to be made. It is accomplished by replacing the following line in java.security:
ssl.KeyManagerFactory.algorithm=SunX509
with
ssl.KeyManagerFactory.algorithm=PKIX
It is also better to disable older SSL and TLS algorithms. This is because the algorithms required for SSL/TLS versions before TLS v2.0 are not available in BCFIPS approved mode. To disable the older algorithms, locate the jdk.tls.disabledAlgorithms entry. For example,
jdk.tls.disabledAlgorithms=SSLv3, RC4, MD5withRSA, DH keySize < 1024, \ EC keySize < 224, DES40_CBC, RC4_40, 3DES_EDE_CBC
Add TLSv1 and TLSv1.1 to the list:
jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, RC4, MD5withRSA, DH keySize < 1024, \ EC keySize < 224, DES40_CBC, RC4_40, 3DES_EDE_CBC
Disabling TLSv1 and TLSv1.1 is optional, however it prevents cryptic error messages when OSP attempts to securely connect with services (such as, LDAP) that only support TLS v1.1 or earlier. The error messages that appear when the earlier TLS versions are disabled are more understandable and directly indicate the problem.
NOTE:eDirectory 8.8 (or earlier) cannot be used with secure LDAP because it only supports TLS v1.0. If you want to use secure LDAP, you must use eDirectory 9 or later. Another alternative is to modify the default keystore type. Find the keystore.type=jks or keystore.type=pkcs12 line and change it to keystore.type=bcfks.