4.2. Configuring Data Grid Server on a system with FIPS 140-2 compliant cryptography
FIPS (Federal Information Processing Standards) are standards and guidelines for US federal computer systems. Although FIPS are developed for use by the US federal government, many in the private sector voluntarily use these standards.
FIPS 140-2 defines security requirements for cryptographic modules. You can configure your Data Grid Server to use encryption ciphers that adhere to the FIPS 140-2 specification by using alternative JDK security providers.
Additional resources
4.2.1. Configuring the PKCS11 cryptographic provider リンクのコピーリンクがクリップボードにコピーされました!
You can configure the PKCS11 cryptographic provider by specifying the PKCS11 keystore with the SunPKCS11-NSS-FIPS provider.
Prerequisites
-
Configure your system for FIPS mode. You can check if your system has FIPS Mode enabled by issuing the
fips-mode-setup --checkcommand in your Data Grid command-line Interface (CLI) -
Initialize the system-wide NSS database by using the
certutiltool. -
Install the JDK with the
java.securityfile configured to enable theSunPKCS11provider. This provider points to the NSS database and the SSL provider. - Install a certificate in the NSS database.
Procedure
- Open your Data Grid Server configuration for editing.
-
Add a
server-identitiesdefinition to the Data Grid Server security realm. -
Specify the PKCS11 keystore with the
SunPKCS11-NSS-FIPSprovider. - Save the changes to your configuration.
Keystore configuration
XML
<server xmlns="urn:infinispan:server:16.0">
<security>
<security-realms>
<security-realm name="default">
<server-identities>
<ssl>
<!-- Adds a keystore that reads certificates from the NSS database. -->
<keystore provider="SunPKCS11-NSS-FIPS" type="PKCS11"/>
</ssl>
</server-identities>
</security-realm>
</security-realms>
</security>
</server>
JSON
{
"server": {
"security": {
"security-realms": [{
"name": "default",
"server-identities": {
"ssl": {
"keystore": {
"provider": "SunPKCS11-NSS-FIPS",
"type": "PKCS11"
}
}
}
}]
}
}
}
YAML
server:
security:
securityRealms:
- name: "default"
serverIdentities:
ssl:
keystore:
provider: "SunPKCS11-NSS-FIPS"
type: "PKCS11"