Enabling FIPS for Tomcat
summary
Shows how to run Tomcat 9.0.52 on Java 8 with the bouncy castle fips provider and a Tomcat lifecycle listener that registers it and reconfigures JSSE so JVM TLS and HTTPS calls use FIPS-approved algorithms. Uses BCFKS keystore (PKCS12 didn’t work for all modes), sets the FIPS-enforce flag so startup fails on non-approved crypto, and demonstrates that 1024-bit key generation fails while 2048+ succeeds. Notes blocking entropy (/dev/random), JSSE key/trust manager limits, and the need for automation.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:01Veritas context
- 3:25What and why of FIPS
- 6:26Benefits of FIPS
- 11:22FIPS journey levels
- 13:47Prerequisites
- 17:15Configuration and code
- 21:48Integration points
- 25:18Live demo
- 30:30Application considerations
- 34:00Provider choices
- 35:42Key learnings
- 39:21Technical challenges
- 44:27Q&A and conclusion
related talks
10mUnconference Session: From RFP to Fips
51mMonitoring Java Application Security with JDK tools and JFR Events
23mApache Spark meets FIPS standard
44mMaking the JDK More Secure
25mFIPS 140-2 in BEAM Apps
52mMonitoring Java Application Security with JDK Tools and JFR Events
37mKeeping Your Java Applications Secure - Cryptographic Improvements and Best Practices
27mOpenSSL and QUIC using FFM