java-1.8.0-openjdk/nss.fips.cfg.in

name = NSS-FIPS
nssLibraryDirectory = @NSS_LIBDIR@
nssSecmodDirectory = sql:/etc/pki/nssdb
nssDbMode = readOnly
nssModule = fips

attributes(*,CKO_SECRET_KEY,CKK_GENERIC_SECRET)={ CKA_SIGN=true }
Support the FIPS mode crypto policy. Backport FIPS mode patch to java-1.8.0-openjdk, simplifying provider removal. nss.fips.cfg needs to be moved to %%{etcjavadir} and symlinked into the JDK, like nss.cfg SunPKCS11 runtime provider name is a concatenation of "SunPKCS11-" and the name in the config file. Change nss.fips.cfg config name to "NSS-FIPS" to avoid confusion with nss.cfg. Disable FIPS mode support unless com.redhat.fips is set to "true". Add JDK-8195607/PR3776 to support NSS SQLite databases. Use appropriate keystore types when in FIPS mode (RH1760838) Enable alignment with FIPS crypto policy by default (-Dcom.redhat.fips=false to disable). Disable TLSv1.3 when using the NSS-FIPS provider (RH1860986) Move setup of JavaSecuritySystemConfiguratorAccess to Security class so it always occurs (RH1906862) Add explicit runtime dependency on NSS for the PKCS11 provider in FIPS mode Resolves: rhbz#1971696 2021-07-08 04:11:48 +00:00			`name = NSS-FIPS`
			`nssLibraryDirectory = @NSS_LIBDIR@`
Use 'sql:' prefix in nss.fips.cfg Fedora 35 and better no longer ship the legacy secmod.db file as part of the nss package. Explicitly tell OpenJDK to use sqlite-based sec mode. Resolves: rhbz#2023533 2021-12-06 01:03:47 +00:00			`nssSecmodDirectory = sql:/etc/pki/nssdb`
Support the FIPS mode crypto policy. Backport FIPS mode patch to java-1.8.0-openjdk, simplifying provider removal. nss.fips.cfg needs to be moved to %%{etcjavadir} and symlinked into the JDK, like nss.cfg SunPKCS11 runtime provider name is a concatenation of "SunPKCS11-" and the name in the config file. Change nss.fips.cfg config name to "NSS-FIPS" to avoid confusion with nss.cfg. Disable FIPS mode support unless com.redhat.fips is set to "true". Add JDK-8195607/PR3776 to support NSS SQLite databases. Use appropriate keystore types when in FIPS mode (RH1760838) Enable alignment with FIPS crypto policy by default (-Dcom.redhat.fips=false to disable). Disable TLSv1.3 when using the NSS-FIPS provider (RH1860986) Move setup of JavaSecuritySystemConfiguratorAccess to Security class so it always occurs (RH1906862) Add explicit runtime dependency on NSS for the PKCS11 provider in FIPS mode Resolves: rhbz#1971696 2021-07-08 04:11:48 +00:00			`nssDbMode = readOnly`
			`nssModule = fips`

RH2007331: SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode Use SunPKCS11 Attributes Configuration to set CKA_SIGN=true on SecretKey generate/import operations in FIPS mode, see: https://docs.oracle.com/javase/8/docs/technotes/guides/security/p11guide.html#ATTRS Resolves: rhbz#2102435 2022-06-30 17:59:36 +00:00			`attributes(*,CKO_SECRET_KEY,CKK_GENERIC_SECRET)={ CKA_SIGN=true }`