Using JCE Providers with WebLogic Server

35 Using JCE Providers with WebLogic Server

Learn how Oracle WebLogic Server supports the use of the Jipher and JDK Java Cryptography Extension (JCE) providers.

Using the Jipher JCE Provider

The Jipher JCE provider is an Oracle-developed JCE provider included with WebLogic Server. Jipher 20.0 is located in jipher-jce-20.0.jar, which is in the WebLogic Server classpath by default. Jipher uses an OpenSSL FIPS 140-3 module as its underlying cryptographic implementation.

Note:

In Jipher 20.0, the runtime native library dependencies are no longer embedded in the jipher-jce JAR, as they were in Jipher 10.x. Standard WebLogic Server launch scripts will now configure the platform-specific libraries under WL_HOME/server/native.

If you launch a WebLogic Server Java process directly or replace the standard environment scripts, ensure you preserve the Jipher options established by commEnv/commBaseEnv, including the platform-specific jipher.openssl.dir and jipher.jniadapter.jipherffi.dir locations. In JDK 25 and later, the launch must also enable native access as described in Permit Native Access in Jipher's User Guide.

For a full list of changes, see Oracle Jipher 20 Release Notes.

Registering Jipher makes its cryptographic services available to WebLogic Server, but provider registration alone does not establish a FIPS 140-3-compliant configuration. For the WebLogic Server integration steps, see Enabling FIPS 140-3 Mode with Jipher JCE and SunJSSE Providers.

For general information on Jipher, see What is Oracle Jipher? in Jipher User Guide.

You can register the Jipher JCE provider by customizing the java.security properties file in the deployment environment to modify the registered provider list or specify a system property on the command line.

Override the default java.security file - note the double equal signs.

java -Djava.security.properties==/etc/sysconfig/jvm1.java.security

Append or override parts of the java.security file - note the single equal sign.
```
java -Djava.security.properties=/etc/sysconfig/jvm.java.security
```

If you cannot or do not want to customize the java.security file, you can also configure WebLogic server to automatically register the Jipher JCE provider during startup. See Automatically Register the Jipher JCE Provider.

If you require support for non-FIPS compliant algorithms, you can register another JCE provider in a position below Jipher JCE, and the non-FIPS compliant algorithms will fall through to use that provider instead.

Automatically Register the Jipher JCE Provider

In scenarios where you may not want to edit the java.security file, you can instead automatically register the Jipher JCE provider at runtime.

Set the weblogic.security.autoRegisterJipherJceProvider system property to register the Jipher JCE provider at the first position in the Java security provider list. If the Jipher JCE provider is already registered at a lower position, WebLogic Server moves it to the first position. If it's already in first position, the system property has no effect. Other providers retain their relative order.

Note:

Registering the Jipher JCE provider does not force every cryptographic operation to use Jipher nor does it imply a compliant FIPS-140-3 configuration.

How you set weblogic.security.autoRegisterJipherJceProvider depends on how you start your servers. Additionally, depending on the structure of your domain, you may need to set weblogic.security.autoRegisterJipherJceProvider in multiple locations.

Note:

JVM startup will fail if Jipher cannot be loaded or initialized, cannot be inserted at position 1, or if the name JipherJCE is already registered by a different provider class.

Using Startup Scripts

Update the setUserOverrides.* file as follows:
- Unix: In DOMAIN_HOME/bin/setUserOverrides.sh, add
```
EXTRA_JAVA_PROPERTIES="${EXTRA_JAVA_PROPERTIES} -Dweblogic.security.autoRegisterJipherJceProvider=true"
export EXTRA_JAVA_PROPERTIES
```
- Windows: In DOMAIN_HOME\bin\setUserOverrides.cmd, add
```
set "EXTRA_JAVA_PROPERTIES=%EXTRA_JAVA_PROPERTIES% -Dweblogic.security.autoRegisterJipherJceProvider=true"
```
Customizing Domain Wide Server Parameters in Administering Server Startup and Shutdown for Oracle WebLogic Server.
If using Node Manager to start servers, you also need to:
1. Make sure weblogic.StartScriptEnabled=true in the nodemanager.properties file, which instructs Node Manager to use the startup scripts you set in setUserOverrides.
2. Add -Dweblogic.security.autoRegisterJipherJceProvider=true to the JAVA_OPTIONS environment variable to enable the Jipher JCE provider on Node Manager.
3. Restart the Node Manager JVM.
See Configuring Node Manager to Use Start and Stop Scripts in Administering Node Manager for Oracle WebLogic Server.
Start the servers.

Using Node Manager without Startup Scripts

Add -Dweblogic.security.autoRegisterJipherJceProvider=true to the JAVA_OPTIONS environment variable to enable the Jipher JCE on Node Manager itself.
On the Administration Server and on every Managed Server, add -Dweblogic.security.autoRegisterJipherJceProvider=true to the server start arguments. (ServerStartMBean.Arguments).
Restart the Node Manager JVM.
Restart the server JVMs.

See:

Using WLST and Node Manager to Manage Servers in Understanding the WebLogic Scripting Tool
Configure Startup Arguments in Oracle WebLogic Remote Console Online Help

Using the JDK JCE Provider

WebLogic Server supports the use of the JDK JCE provider (SunJCE).

For more information about the features in SunJCE, see the Java Cryptography Architecture (JCA) Reference Guide in Java SE Security Developer's Guide.

Current JDK releases use the unlimited cryptographic jurisdiction policy by default. The active policy is selected by the crypto.policy security property in the JDK java.security file. A limited policy remains available for environments that require it, and Java also supports customized policy files.