Enabling FIPS 140.3 for Oracle Grid Infrastructure
Use this procedure to enable FIPS 140.3 on a newly installed or existing Oracle Grid Infrastructure cluster. Install the required FIPS 140.3 supporting fixes on every cluster node before you enable FIPS 140.3 on any node.
When FIPS 140.3 is enabled on a node, GPnP signs the profile using RSA-SHA512. When FIPS 140.3 is disabled on a node, GPnP continues to sign the profile using RSA-SHA1.
Before You Enable FIPS 140.3
- Confirm that the required FIPS 140.3 supporting fixes are installed on every cluster node.
- For a new cluster, verify that the installed release or applied patches include the fixes on every node. If an existing cluster does not meet this requirement, first follow Patching, Upgrading, and Downgrading Oracle Grid Infrastructure with FIPS 140.3.
- See the patch README or release-specific support guidance to identify the required fixes for your platform.
- FIPS 140.3 must be enabled on every cluster node for a consistent FIPS-enabled configuration. During a rolling upgrade or patching, a mixed setting is supported without requiring cluster downtime, but it is not recommended as a steady-state configuration.
Supported Configurations
| FIPS 140.3 supporting fixes | FIPS 140.3 enabled | Support and profile signing |
|---|---|---|
| Installed on all cluster nodes | Enabled on all nodes | Supported and recommended. GPnP profiles are signed using RSA-SHA512. |
| Installed on all cluster nodes | Disabled on all nodes | Supported. GPnP profiles continue to be signed using RSA-SHA1. |
| Installed on all cluster nodes | Enabled on some nodes only | Supported during a rolling upgrade or patching without requiring cluster downtime, but not recommended as a steady-state configuration. Nodes with FIPS enabled sign the profile using RSA-SHA512; other nodes use RSA-SHA1. |
| Installed on only some cluster nodes | Enabled on any node | Not supported. Install the fixes on every node before enabling FIPS 140.3. |
Enabling FIPS 140.3 in a Rolling Mode
After you install the required fixes on every node, enable FIPS 140.3 in a rolling mode:
- Stop the Oracle Grid Infrastructure stack on one node.
- Enable FIPS 140.3 by using the configuration procedure for your platform and release.
- Restart the Oracle Grid Infrastructure stack on that node.
- Confirm that the stack and GPnP service start successfully.
- Repeat steps 1 through 4 on each remaining node.
Note:
The procedure for enabling FIPS 140.3 depends on your platform and release. Do not enable FIPS 140.3 on any node before the required fixes are installed on every cluster node.