Connect 4.7 - FIPS Configuration Issue Windows 64 bit

classic Classic list List threaded Threaded
4 messages Options
Reply | Threaded
Open this post in threaded view
|

Connect 4.7 - FIPS Configuration Issue Windows 64 bit

aparcelli
Versions:
Windows (64-bit)
Connect 4.7
Wildfly 8.2.1
Java JDK 1.8u111

I was able to get Connect 4.7 deployed to a WildFly 8.2.1 server and validated. Now I am trying to configure the server for FIPS 140-2 compliance. I have been following the instructions here: https://connectopensource.atlassian.net/wiki/display/CONNECTWIKI/Wildfly+8.2.1+with+FIPS+140-2+Configuration.

But since I am on Windows I needed to stray a little. I have downloaded the nss library from mozilla here: https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_12_4_RTM/msvc9/WINNT5.1_OPT.OBJ/ and unpacked it on my server at C:/nss.

I am able to create a nss database at C:/nss/fips/db.

And I have put the pkcs11.cfg file in C:/nss/fips/config.
Here is what is in my pkcs11.cfg:
name = nss-fips
nssLibraryDirectory = C:/nss/lib
nssSecmodDirectory = C:/nss/fips/db
nssModule = fips

Modification I made to java.security:
security.provider.1=sun.security.pkcs11.SunPKCS11 C:/nss/fips/config/pkcs11.cfg
and then incremented all other providers.

The issue I'm seeing when I try to use keytool after adding the configuration (for example: keytool -list -storetype pkcs11) is "keytool error: java.security.ProviderException: Could not initialize NSS"

I assume it is something wrong with my configuration but I'm not able to figure it out. Any help is appreciated.

Thanks,
Tony
Reply | Threaded
Open this post in threaded view
|

Re: Connect 4.7 - FIPS Configuration Issue Windows 64 bit

aparcelli
I was able to fix this issue by building NSS from the source of 3.12.4 using the 64 bit option.

Source location:
https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_12_4_RTM/src/nss-3.12.4-with-nspr-4.8.tar.gz

I used:
https://developer.mozilla.org/en-US/docs/Mozilla/Developer_guide/Build_Instructions/Windows_Prerequisites#MozillaBuild
It comes with a .bat that will open a bash that can build nss without changing your environment.

Directions found here: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_Sources_Building_Testing#Building_NSS

Reply | Threaded
Open this post in threaded view
|

Re: Connect 4.7 - FIPS Configuration Issue Windows 64 bit

Minh
Administrator
This is awesome  news.  Thank you for providing the link and direction.
Minh-Hai Nguyen
CONNECT Product Team Member
Reply | Threaded
Open this post in threaded view
|

Re: Connect 4.7 - FIPS Configuration Issue Windows 64 bit

yaramati
Hi  ,

Have you built NSS from the source of 3.12.4 using the 64-bit options?

Kindly send us the NSS 3.12.4 with 64-bit options, we would like to validate some functionality in my product. Your help is appreciated in this regards.

regards
Pra