37 Enabling FIPS Mode

FIPS Overview

The Federal Information Processing Standards (FIPS) 140-2 is a standard that describes U.S. Federal government requirements for sensitive but unclassified use.

WebLogic Server supports the use of the RSA FIPS-compliant (FIPS 140-2) crypto module. (See Supported FIPS Standards and Cipher Suites for supported versions.)

When used in combination with the RSA JSSE and RSA JCE providers, this crypto module provides a FIPS-compliant (FIPS 140-2) implementation.

See "FIPS-140 Support in Oracle Fusion Middleware" in Administering Oracle Fusion Middleware Oracle Fusion Middleware for detailed information about Oracle Fusion Middleware support for FIPS.

Enabling FIPS 140-2 Mode From Java Options

To enable FIPS 140-2 mode from Java options, follow these steps:

1. Using the following URL, download and install the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files that correspond to the version of your JDK. These Java policy JAR files affect cipher key sizes greater than 128 bits.

   http://www.oracle.com/technetwork/java/javase/downloads/index.html
   

   Open the .ZIP distribution and update local_policy.jar and US_export_policy.jar in JAVA_HOME/jre/lib/security. See the README.txt file in the .ZIP distribution for more information and installation instructions.

2. Create your own java.security file. You can use the one that comes with the installed JDK as a guide.

   Add both the RSA JCE provider and the RSA JSSE provider as the first two Java security providers listed in your java.security properties file:

   #
   security.provider.1=com.rsa.jsafe.provider.JsafeJCE
   security.provider.2=com.rsa.jsse.JsseProvider
    
   security.provider.3=sun.security.provider.Sun
   :
   

3. Set -Djava.security.properties on the WebLogic Server start command line to override the default configuration in the java.security file. Specify a full file path to your custom java.security file:

   set JAVA_OPTIONS=-Djava.security.properties=C:\Users\user\java.security
   

   Note:

   Use a single equal sign (=) to specify a filename if you want the java.security properties to be appended to the installed JRE security properties. Use two equal signs (==) if you want to override all the Java security properties, for instance, -Djava.security.properties==C:\Users\user\java.security.

4. Put the jcmFIPS.jar jar and sslj.jar JAR files (both are in WL_HOME/server/lib/) at the head of the classpath. You can use the PRE_CLASSPATH environment variable to do this.

   (The RSA JCE provider Crypto-J is located in cryptoj.jar and is in the classpath by default.)

   For example, you could set jcmFIPS.jar and sslj.jar in the PRE_CLASSPATH variable before you call the server start script, typically startWebLogic.cmd/sh:

   set PRE_CLASSPATH=%MW_HOME%\wlserver\server\lib\jcmFIPS.jar;%MW_HOME%\wlserver\server\lib\sslj.jar
   cd %MW_HOME%\user_projects\domains\base_domain
   startWebLogic.cmd
   

5. Start WebLogic Server.

Enabling FIPS 140-2 Mode From java.security

To enable FIPS 140-2 mode from the installed JDK java.security file, follow these steps:

1. Using the following URL, download and install the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files that correspond to the version of your JDK. These Java policy JAR files affect cipher key sizes greater than 128 bits.

   See the README.txt file in the .ZIP distribution for installation instructions.

   http://www.oracle.com/technetwork/java/javase/downloads/index.html
   

   Open the .ZIP distribution and update local_policy.jar and US_export_policy.jar in JAVA_HOME/jre/lib/security. See the README.txt file in the ZIP distribution for more information and installation instructions.

2. Edit the java.security file. Add both the RSA JCE provider and the RSA JSSE provider as the first two Java security providers listed in the java.security properties file:

   #
   security.provider.1=com.rsa.jsafe.provider.JsafeJCE
   security.provider.2=com.rsa.jsse.JsseProvider
    
   security.provider.3=sun.security.provider.Sun
   :
   

3. Put the jcmFIPS.jar jar and sslj.jar JAR files (both are in WL_HOME/server/lib/) at the head of the classpath. You can use the PRE_CLASSPATH environment variable to do this.

   (The RSA JCE provider Crypto-J is located in cryptoj.jar and is in the classpath by default.)

   For example, you could set jcmFIPS.jar and sslj.jar in the PRE_CLASSPATH variable before you call the server start script, typically startWebLogic.cmd/sh:

   set PRE_CLASSPATH=%MW_HOME%\wlserver\server\lib\jcmFIPS.jar;%MW_HOME%\wlserver\server\lib\sslj.jar
   cd %MW_HOME%\user_projects\domains\base_domain
   startWebLogic.cmd
   

   Or, you could add jcmFIPS.jar and sslj.jar to the PRE_CLASSPATH variable in the server start script itself.

4. Start WebLogic Server.

Verifying JCE When FIPS 140-2 Mode is Enabled

During normal WebLogic startup, for performance reasons the RSA Crypto-J JCE Self-Integrity test is disabled.

If you want to make sure that JCE verification is enabled when configuring WLS for FIPS 140-2 mode, set the -Dweblogic.security.allowCryptoJDefaultJCEVerification=true JAVA_OPTIONS environment variable when you start WebLogic Server.

Note that setting this environment variable adds additional processing and time to the startup.

Important Considerations When Using Web Services

For FIPS 140-2 mode, all certificates must have a key size of 2048 bits in length.

Please keep the following additional considerations in mind when using web services in FIPS 140-2 mode:

• SHA-1 Secure Hash Algorithm Not Supported

• X509PKIPathv1 token Not Supported

<sp:AlgorithmSuite>
        <wsp:Policy>
             <sp:Basic256/>
        </wsp:Policy>
</sp:AlgorithmSuite>

<sp:AlgorithmSuite>
         <wsp:Policy>
             <sp:Basic256Sha256/>
         </wsp:Policy>
</sp:AlgorithmSuite>

<wsp:Policy>
   <sp:X509Token sp:IncludeToken=". . .">
         <wsp:Policy>
               <sp:WssX509PkiPathV1Token10/>
         </wsp:Policy>
   </sp:X509Token>
</wsp:Policy>

<wsp:Policy>
   <sp:X509Token sp:IncludeToken=". . .">
         <wsp:Policy>
               <sp:WssX509Pkcs7Token10/>
         </wsp:Policy>
   </sp:X509Token>
</wsp:Policy>

<wsp:Policy>
   <sp:X509Token sp:IncludeToken=". . .">
         <wsp:Policy>
              <sp:RequireThumbprintReference/>
              <sp:WssX509PkiPathV1Token11/>
         </wsp:Policy>
   </sp:X509Token>
</wsp:Policy>

<wsp:Policy>
   <sp:X509Token sp:IncludeToken=". . .">
         <wsp:Policy>
               <sp:RequireThumbprintReference/>
               <sp:WssX509Pkcs7Token11/>
         </wsp:Policy>
   </sp:X509Token>
</wsp:Policy>