3 Commits

Author	SHA1	Message	Date
Francisco Ferrari Bihurriet	2d53004059	RH2007331: SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode ... Use SunPKCS11 Attributes Configuration to set CKA_SIGN=true on SecretKey generate/import operations in FIPS mode, see: https://docs.oracle.com/javase/8/docs/technotes/guides/security/p11guide.html#ATTRS	2022-06-30 15:17:23 -03:00
Severin Gehwolf	b1a7d3ba42	Use 'sql:' prefix in nss.fips.cfg ... Fedora 35 and better no longer ship the legacy secmod.db file as part of the nss package. Explicitly tell OpenJDK to use sqlite-based sec mode. Resolves: RHBZ#2019555	2021-11-05 18:31:57 +01:00
Andrew Hughes	0e6069cde3	Support the FIPS mode crypto policy. ... Backport FIPS mode patch to java-1.8.0-openjdk, simplifying provider removal. nss.fips.cfg needs to be moved to %%{etcjavadir} and symlinked into the JDK, like nss.cfg SunPKCS11 runtime provider name is a concatenation of "SunPKCS11-" and the name in the config file. Change nss.fips.cfg config name to "NSS-FIPS" to avoid confusion with nss.cfg. Disable FIPS mode support unless com.redhat.fips is set to "true". Add JDK-8195607/PR3776 to support NSS SQLite databases. Use appropriate keystore types when in FIPS mode (RH1760838) Enable alignment with FIPS crypto policy by default (-Dcom.redhat.fips=false to disable). Disable TLSv1.3 when using the NSS-FIPS provider (RH1860986) Move setup of JavaSecuritySystemConfiguratorAccess to Security class so it always occurs (RH1906862) Add explicit runtime dependency on NSS for the PKCS11 provider in FIPS mode	2021-06-08 05:46:02 +01:00