candlepin/candlepin — pull request #530 by dgoodwin (2014-03-06 12:34:19+00:00)
Title: Allow Candlepin To Run on FIPS server / JVM

These changes allow Candlepin to run when configured on a server that is in FIPS mode, as well as on a JVM that is in FIPS mode. (default JCE provider set to SunPKCS11)

A JVM can be put into FIPS mode by doing the following: http://blog.johnruiz.com/2013/12/configure-fips-140-2-compliant-java.html On Fedora 20, you may have keystore complaints on tomcat startup, I have not figured out how to work around that yet but we suspect it can be done with keytool. Some F20 systems did not encounter this issue.

It also appears that RHEL JDK 7 is using this JCE provider by default.

The first change allows us to read a server CA PEM file which is in PKCS8 (unencrypted) form (which seems to be what is generated when you run our openssl setup commands on a FIPS enabled server), in addition to the PKCS1 format we generate/read normally.

The second change disables anonymous ECDH ciphers that probably never should have been in our tomcat config in the first place, and adds a more secure ECDHE cipher. More details in specific commit for that.

Unable to come up with any logical ways to automate testing for these issues, so no tests are included at this time.