2 Downloading and Deploying Jipher

Downloading Jipher

Download Jipher from Java Verified Portfolio.

Note:

On macOS, downloaded files are usually marked with a quarantine attribute. After verifying the SHA-256 hash of the downloaded package remove the quarantine attribute before installing the the package contents on macOS.

xattr -d com.apple.quarantine jipher-20.0-macos-aarch64.tar.gz

Jipher Deployment

  1. Extract Jipher's native library dependency archive, jipher-native-20.0-<platform>.tar.gz, from jipher-20.0-<platform>.tar.gz.

  2. Install Jipher's native library dependencies by extracting them from the native library dependency archive to a location in the file system.

    Jipher's native library dependency archive contains the following:

    • Certified OpenSSL module: A version of the OpenSSL FIPS module built from source code that has been tested by an accredited Cryptographic and Security Testing Laboratory (CSTL), validated by the Cryptographic Module Validation Program (CMVP), and issued a FIPS 140-3 validation certificate
    • Patched OpenSSL module: A version of the OpenSSL FIPS module built from the FIPS 140-3 compliant baseline source code with additional security patches applied, which is used by default

    The following command extracts the patched OpenSSL module for a PLATFORM to a TARGETPATH: 

    tar -xf jipher-native-20.0-${PLATFORM}.tar.gz -C "${TARGETPATH}" --strip-components=2 "patched/${PLATFORM}"

    The following command extracts the certified OpenSSL module for a PLATFORM to a TARGETPATH: 

    tar -xf jipher-native-20.0-${PLATFORM}.tar.gz-C "${TARGETPATH}" --strip-components=2 "certified/${PLATFORM}"

    Note:

    By default Jipher loads its native library dependencies from a platform-specific location:
    • Linux and macOS: /opt/jipher
    • Windows: C:\Program Files\jipher

    If you extract the native library dependencies to this location then no further configuration is required. Otherwise, you must specify the location of Jipher's native library dependencies through system properties. See Configuring Jipher Through System and Security Properties.

    Caution:

    Ensure that Jipher's native library dependencies and the directory in which these files are stored are owned by a highly privileged operating system account and write permissions are restricted to that account (or an equivalent administrative group). Standard users should not have permission to modify, replace, or delete these files. Restricting write access in this manner reduces the risk of an attacker replacing the native library dependency libraries with malicious versions.
  3. Extract the Jipher JAR file, jipher-jce-20.0.jar, from jipher-20.0-<platform>.tar.gz. Add the Jipher JAR file to your class path or your module path. When placed on the module path, it will be observable as the module com.oracle.jipher.

Note:

The JCA authenticates a security provider by verifying the JAR file's signature at runtime. See Registering the SUN Provider for JAR File Signature Verification. Consequently, you cannot extract the contents of the Jipher JAR file and incorporate them into a JAR with dependencies (a JAR file that contains not only a Java application but includes its dependencies) to simplify deployment.

Permit Native Access

Starting in JDK 25, Jipher uses the Foreign Function and Memory (FFM) API to access OpenSSL. Some of the FFM API methods used by Jipher are restricted. See Restricted Methods in Java Platform, Standard Edition Core Libraries. To enable Jipher to access these methods, add one of the following command-line options when you run your Java application depending on where you specified the Jipher JAR file:

  • On the class path:

    --enable-native-access=ALL-UNNAMED

  • On the module path:

    --enable-native-access=com.oracle.jipher

Check the Version of Your Jipher Deployment

Jipher is distributed as a Java module. Launching the module invokes its main class, which prints version information and then exits.

Running the module is a simple way to verify that the Jipher native libraries can be loaded successfully. If running the module prints version information without any errors, then the native libraries have been loaded correctly.

Run the Jipher module as follows: 

java --enable-native-access=com.oracle.jipher \
     --module-path jipher-jce-20.0.jar \
     --module com.oracle.jipher

This command should print output similar to the following:

JipherJCE Provider 20.0 [OpenSSL 3.6.3+oracle.jipher 9 Jun 2026 with OpenSSL FIPS Provider version 3.5.7] (implements AES, DESede, Diffie-Hellman, DSA, ML-KEM, ML-DSA, ECDSA, ECDH, HMAC, PBKDF2, RSA, SHA-1, SHA-2, SHA-3)

See Reporting Misconfiguration if this command reports any errors.