Chapter 3. FIPS automation in Red Hat build of OpenJDK 17

When FIPS mode is enabled, Red Hat build of OpenJDK 17 replaces the installed security providers with a constrained list. Some security services and algorithms might be dropped, so that only a FIPS-certified module performs cryptographic operations. The following list describes installed security providers, services, algorithms and enabled configurations:

In FIPS mode, Red Hat build of OpenJDK 17 takes the list of disabled cryptographic algorithms and other configurations from the global FIPS crypto-policy in RHEL. You can find these values at /etc/crypto-policies/back-ends/java.config. You can use the update-crypto-policies tool from RHEL to consistently manage crypto-policies.

In FIPS mode, Red Hat build of OpenJDK 17 uses the global Trust Anchor certificates repository by default. This behavior is equivalent to non-FIPS mode. This repository is located at /etc/pki/java/cacerts. Use the update-ca-trust tool from RHEL to consistently manage certificates. Optionally, you can store Trust Anchor certificates in your own PKCS12 and PKCS11 keystores, and use them for TLS communication. For more information, see the TrustManagerFactory::init documentation.

When the javax.net.ssl.trustStoreType system property is not set and FIPS mode is enabled, Red Hat build of OpenJDK 17 automatically sets this system property to the value of the keystore.type security property. This behavior is equivalent to non-FIPS mode.

In FIPS mode, Red Hat build of OpenJDK 17 enables the use of the PKCS12 and PKCS11 keystore types. PKCS12 is used by default. You can change the default keystore type by using the fips.keystore.type security property. An application can also select which keystore type to use when invoking KeyStore.getInstance(<type>).

When opening a PKCS11 keystore, Red Hat build of OpenJDK 17 uses the SQLite NSS DB located at /etc/pki/nssdb. This NSS DB might be unsuitable to store keys. You can specify a different database by setting a value for the fips.nssdb.path property. For more information and security considerations, see FIPS settings in Red Hat build of OpenJDK 17.

When you set the fips.keystore.type security property to PKCS11 and FIPS mode is enabled, Red Hat build of OpenJDK 17 automatically assigns the javax.net.ssl.keyStore system property to a value of NONE. This behavior facilitates the use of PKCS#11 keystores by saving a manual configuration step. For more information, see JDK-8238264.

Revised on 2024-11-25 10:51:45 UTC