53 lines
2.7 KiB
Diff
53 lines
2.7 KiB
Diff
diff -r 6efbd7b35a10 src/share/classes/java/security/SystemConfigurator.java
|
|
--- openjdk.orig/jdk/src/share/classes/java/security/SystemConfigurator.java Thu Jan 23 18:22:31 2020 -0300
|
|
+++ openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java Mon Mar 02 19:20:17 2020 -0300
|
|
@@ -123,6 +123,33 @@
|
|
}
|
|
props.put(fipsProviderKey, fipsProviderValue);
|
|
}
|
|
+ // Add other security properties
|
|
+ String keystoreTypeValue = (String) props.get("fips.keystore.type");
|
|
+ if (keystoreTypeValue != null) {
|
|
+ String nonFipsKeystoreType = props.getProperty("keystore.type");
|
|
+ props.put("keystore.type", keystoreTypeValue);
|
|
+ if (keystoreTypeValue.equals("PKCS11")) {
|
|
+ // If keystore.type is PKCS11, javax.net.ssl.keyStore
|
|
+ // must be "NONE". See JDK-8238264.
|
|
+ System.setProperty("javax.net.ssl.keyStore", "NONE");
|
|
+ }
|
|
+ if (System.getProperty("javax.net.ssl.trustStoreType") == null) {
|
|
+ // If no trustStoreType has been set, use the
|
|
+ // previous keystore.type under FIPS mode. In
|
|
+ // a default configuration, the Trust Store will
|
|
+ // be 'cacerts' (JKS type).
|
|
+ System.setProperty("javax.net.ssl.trustStoreType",
|
|
+ nonFipsKeystoreType);
|
|
+ }
|
|
+ if (sdebug != null) {
|
|
+ sdebug.println("FIPS mode default keystore.type = " +
|
|
+ keystoreTypeValue);
|
|
+ sdebug.println("FIPS mode javax.net.ssl.keyStore = " +
|
|
+ System.getProperty("javax.net.ssl.keyStore", ""));
|
|
+ sdebug.println("FIPS mode javax.net.ssl.trustStoreType = " +
|
|
+ System.getProperty("javax.net.ssl.trustStoreType", ""));
|
|
+ }
|
|
+ }
|
|
loadedProps = true;
|
|
}
|
|
} catch (Exception e) {
|
|
diff -r 6efbd7b35a10 src/share/lib/security/java.security-linux
|
|
--- openjdk.orig/jdk/src/share/lib/security/java.security-linux Thu Jan 23 18:22:31 2020 -0300
|
|
+++ openjdk/jdk/src/share/lib/security/java.security-linux Mon Mar 02 19:20:17 2020 -0300
|
|
@@ -179,6 +179,11 @@
|
|
keystore.type=jks
|
|
|
|
#
|
|
+# Default keystore type used when global crypto-policies are set to FIPS.
|
|
+#
|
|
+fips.keystore.type=PKCS11
|
|
+
|
|
+#
|
|
# Controls compatibility mode for the JKS keystore type.
|
|
#
|
|
# When set to 'true', the JKS keystore type supports loading
|