Configuring Federal Information Processing Standard Java Secure Socket Extension files

Use this topic to configure Federal Information Processing Standard Java Secure Socket Extension files.

About this task

In WebSphere® Application Server, the Java Secure Socket Extension (JSSE) provider used is the IBMJSSE2 provider. This provider delegates encryption and signature functions to the Java Cryptography Extension (JCE) provider. Consequently, IBMJSSE2 does not need to be Federal Information Processing Standard (FIPS)-approved because it does not perform cryptography. However, the JCE provider requires FIPS-approval.
WebSphere Application Server provides a FIPS-approved IBMJCEFIPS provider that IBMJSSE2 can utilize. The IBMJCEFIPS provider that is shipped in WebSphere Application Server Version 8.0 supports the following SSL ciphers:
  • SSL_RSA_WITH_AES_128_CBC_SHA
  • SSL_RSA_WITH_3DES_EDE_CBC_SHA
  • SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
  • SSL_DHE_RSA_WITH_AES_128_CBC_SHA
  • SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
  • SSL_DHE_DSS_WITH_AES_128_CBC_SHA
  • SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA

Even though the IBMJSSEFIPS provider is still present, the runtime does not use this provider. If IBMJSSEFIPS is specified as a contextProvider, WebSphere Application Server automatically defaults to the IBMJSSE2 provider (with the IBMJCEFIPS provider) for supporting FIPS. When enabling the Use the United States Federal Information Processing Standard (FIPS) algorithms option on the server SSL certificate and key management panel, the runtime always uses IBMJSSE2, despite the contextProvider that you specify for SSL (IBMJSSE, IBMJSSE2 or IBMJSSEFIPS). Also, because FIPS requires the SSL protocol be TLS, the runtime always uses TLS when FIPS is enabled, regardless of the SSL protocol setting in the SSL repertoire. This simplifies the FIPS configuration in Version 8.0 because an administrator needs to enable only the Use the United States Federal Information Processing Standard (FIPS) algorithms option on the server SSL certificate and key management panel to enable all transports using SSL.

Procedure

  1. Click Security > SSL certificate and key management.
  2. Select the Use the United States Federal Information Processing Standard (FIPS) algorithms option and click Apply. This option makes IBMJSSE2 and IBMJCEFIPS the active providers.
  3. Accommodate Java clients that must access enterprise beans.

    Change the com.ibm.security.useFIPS property value from false to true in the profile_root/properties/ssl.client.props file.

  4. Ensure that the com.ibm.ssl.protocol property within the profile_root/properties/ssl.client.props file is set to SSL_TLS.
  5. Ensure that the java.security file includes the provider.

    Edit the java.security file to insert the IBMJCEFIPS provider (com.ibm.crypto.fips.provider.IBMJCEFIPS) before the IBMJCE provider, and also renumber the other providers in the provider list. The IBMJCEFIPS provider must be in the java.security file provider list.

    The java.security file is located in the WAS_HOME/properties directory.

    For transitioning users For transitioning users: In previous releases of WebSphere Application Server, the java.security file was located in the WAS_HOME/java/lib/security directory. In WebSphere Application Server Version 8.0, the file is now located in the WAS_HOME/properties directory.trns

    Edit the java.security file to comment out the line with the IBMJCEFIPS provider and also renumber the rest of the provider list. The IBMJCEFIPS provider must be in the java.security file provider list.

    The java.security file is a symbolic link to the smpe_root/properties directory. Break the symbolic link and copy the java.security file to the WAS_HOME/properties directory.

    Edit the java.security file to comment out the line with the IBMJCE provider, uncomment the line with the IBMJCEFIPS provider, and save the file.

    The IBM® SDK java.security file looks like the following example after completing this step: [Updated in July 2011]
    security.provider.1=com.ibm.crypto.fips.provider.IBMJCEFIPS 
    security.provider.2=com.ibm.crypto.provider.IBMJCE  
    security.provider.3=com.ibm.jsse.IBMJSSEProvider   
    security.provider.4=com.ibm.jsse2.IBMJSSEProvider2   
    security.provider.5=com.ibm.security.jgss.IBMJGSSProvider 
     security.provider.6=com.ibm.security.cert.IBMCertPath  
    security.provider.7=com.ibm.crypto.pkcs11impl.provider.IBMPKCS11Impl
    security.provider.8=com.ibm.security.cmskeystore.CMSProvider
    security.provider.9=com.ibm.security.jgss.mech.spnego.IBMSPNEGO
    security.provider.10=com.ibm.security.sasl.IBMSASL 
    security.provider.11=com.ibm.xml.crypto.IBMXMLCryptoProvider 
    security.provider.12=com.ibm.xml.enc.IBMXMLEncProvider  
    security.provider.13=org.apache.harmony.security.provider.PolicyProvider
    [Updated in July 2011]
    jul2011

What to do next

After completing these steps, a FIPS-approved JSSE or JCE provider offers increased encryption capabilities. However, when you use FIPS-approved providers:
Note: When enabling FIPS, you cannot configure cryptographic token devices in the SSL repertoires. IBMJSSE2 must use IBMJCEFIPS when utilizing cryptographic services for FIPS.
The following FIPS 140-2 approved cryptographic providers that are the only devices that are supported with the FIPS option:
  • IBMJCEFIPS (certificate 376)
  • IBM Cryptography for C (ICC) (certificate 384)
The relevant certificates are listed on the NIST website: Cryptographic Module Validation Program FIPS 140-1 and FIPS 140-2 Pre-validation List
To unconfigure the FIPS provider, reverse the changes that you made in the previous steps. After you reverse the changes, verify that you have made the following changes to the sas.client.props, soap.client.props, and java.security files:
  • In the ssl.client.props file, you must change the com.ibm.security.useFIPS value to false.
  • In the java.security file, you must change the FIPS provider to a non-FIPS provider.
    If you are using the IBM SDK java.security file, you must change the first provider to a non-FIPS provider as shown in the following example:
    #security.provider.1=com.ibm.crypto.fips.provider.IBMJCEFIPS
    security.provider.1=com.ibm.crypto.provider.IBMJCE
    security.provider.2=com.ibm.jsse.IBMJSSEProvider
    security.provider.3=com.ibm.jsse2.IBMJSSEProvider2
    security.provider.4=com.ibm.security.jgss.IBMJGSSProvider
    security.provider.5=com.ibm.security.cert.IBMCertPath
    #security.provider.6=com.ibm.crypto.pkcs11.provider.IBMPKCS11
    If you are using the Sun JDK java.security file, you must change the third provider to a non-FIPS provider as shown in the following example:
    security.provider.1=sun.security.provider.Sun
    security.provider.2=com.ibm.security.jgss.IBMJGSSProvider
    security.provider.3=com.ibm.crypto.fips.provider.IBMJCEFIPS
    security.provider.4=com.ibm.crypto.provider.IBMJCE
    security.provider.5=com.ibm.jsse.IBMJSSEProvider
    security.provider.6=com.ibm.jsse2.IBMJSSEProvider2
    security.provider.7=com.ibm.security.cert.IBMCertPath
    #security.provider.8=com.ibm.crypto.pkcs11.provider.IBMPKCS11
    
When you use the FIPS provider, the IBM Software Development Kit (SDK) might issue an error message that refers to a bad certificate. Although this error message can result from a multitude of reasons, review your security configuration and consider one of the following actions:
  • Reduce the cipher suite level to Medium, if your cipher suite level is currently Strong.
    Avoid trouble Avoid trouble: You can change the cipher suite level for different levels of your environment such as the node or server level. Limit the change to the level of your environment where the change is necessary.gotcha

    To change the cipher suite, see the cipher suite groups information within the quality of protection settings documentation. If you change the cipher suite level to Medium, save and synchronize the changes. If the Dynamically update the run time when SSL configuration changes occur option is selected, you do not need to restart the server. However, if the option is not selected, you must restart the server for the changes to be effective. The Dynamically update the run time when SSL configuration changes occur option is available within the administrative console on the SSL certificate and key management panel. To access the panel, click Security > SSL certificate and key management.

  • Install security level 3 FMID JCPT3A1 for the z/OS® operating system.

    Security Level 3 FMID JCPT3A1 is the z/OS operating system implementation of the FIPS 140-2 approved cryptographic providers.




In this information ...


Related reference

IBM Redbooks, demos, education, and more

(Index)

Use IBM Suggests to retrieve related content from ibm.com and beyond, identified for your convenience.

This feature requires Internet access.

Task topic Task topic    

Terms of Use | Feedback

Last updatedLast updated: Sep 19, 2011 3:08:41 PM CDT
http://www14.software.ibm.com/webapp/wsbroker/redirect?version=matt&product=was-nd-zos&topic=tsec_fips
File name: tsec_fips.html