Chapter 3. Default FIPS configurations in Red Hat build of OpenJDK 11 Security providers The Red Hat build of OpenJDK security policy is controled by the global java security policy file. You can find the java security policy file at USDJRE_HOME/lib/security/java.security . With FIPS mode enabled, Red Hat build of OpenJDK replaces the installed security providers with the following ones (in descending priority order): SunPKCS11-NSS-FIPS Initialized with a Network Security Services (NSS) Software Token (PKCS#11 backend). The NSS Software Token is configured as follows: name = NSS-FIPS nssLibraryDirectory = /usr/lib64 nssSecmodDirectory = /etc/pki/nssdb nssDbMode = readOnly nssModule = fips The NSS library implements a FIPS-compliant Software Token. Also, FIPS policy-aware in RHEL. SUN For X.509 certificates support only. Make sure that your application is not using other cryptographic algorithms from this provider. For example, MessageDigest.getInstance("SHA-256", Security.getProvider("SUN")) would work but lead to a non-FIPS compliant MessageDigest service. SunEC For SunPKCS11 auxiliary helpers only. Make sure that your application is not explicitly using this provider. SunJSSE Initialized with the SunPKCS11-NSS-FIPS provider for all cryptographic primitives required by the TLS engine, including key derivation. Crypto-policies With FIPS mode enabled, Red Hat build of OpenJDK takes configuration values of cryptographic algorithms from global crypto-policies. You can find these values at /etc/crypto-policies/back-ends/java.config . You can use the update-crypto-policies tooling from RHEL to manage crypto-policies in a consistent way. Note A crypto-policies approved algorithm might not be usable in Red Hat build of OpenJDK's FIPS mode. This occurs when a FIPS-compliant implementation is not available in the NSS library or when it is not supported in Red Hat build of OpenJDK's SunPKCS11 security provider. Trust Anchor certificates Red Hat build of OpenJDK uses the global Trust Anchor certificates repository when in FIPS mode. You can locate this repository at /etc/pki/java/cacerts . Use the update-ca-trust tooling from RHEL to manage certificates in a consistent way. Key store With FIPS mode, Red Hat build of OpenJDK uses the NSS DB as a read-only PKCS#11 store for keys. As a result, the keystore.type security property is set to PKCS11 . You can locate the NSS DB repository at /etc/pki/nssdb . Use the modutil tooling in RHEL to manage NSS DB keys. SunPKCS11 provider configuration attributes The SunPKCS11 provider includes configuration attributes that enhance the usage of native resources, such as key objects. The SunPKCS11 provider must use its native resources to work with native PKCS11 libraries. Table 3.1. SunPKCS11 provider configuration attributes Attribute Type Description destroyTokenAfterLogout boolean Defaults to false . If set to true, when an application invokes the logout() method of the SunPKCS11 provider instance, the underlying token object is deleted by the SunPKCS11 provider instance and resources are released. This renders the SunPKCS11 provider unusable after execution of logout() method calls, so do not add the PKCS11 to the system provider list. cleaner.shortInterval integer Defaults to 2000 milliseconds (ms). The attribute defines the frequency that a cleaner thread removes no-longer-needed native PKCS11 references from the clearing queue to free native memory. Note: The cleaner thread switches to use the cleaner.longInterval attribute value if no native PKCS11 references exist in the clearing queue and the cleaner thread attempts the removal process on the queue more than 200 times. cleaner.longInterval integer Defaults to 60000 milliseconds (ms). The attribute defines the frequency that a cleaner thread checks the clearing queue for native PKCS11 references during non-busy periods of time. Note: The cleaner thread switches to use the cleaner.shortInterval attribute value when the thread detects native PKCS11 references in the clearing queue. Revised on 2024-11-25 10:51:27 UTC

Commands: