Enabling FIPS mode
About this task
Enable FIPS mode to ensure that PingAccess exclusively uses encryption algorithms permitted by the FIPS standard. If your environment is clustered, make sure to perform this procedure on all nodes.
In this procedure, you can manually specify security providers, TLS protocols, and TLS cipher suites that can be used. If your manual inclusions are not FIPS-compliant, your environment might not be FIPS-compliant even in FIPS mode. |
Steps
-
Open the
<PA Home>/conf/fips-mode.properties
file or create it if it’s been removed. -
Set the
pa.fips.mode
property totrue
.Example:
pa.fips.mode=true
-
(Optional) Exempt one or more security providers from being excluded by FIPS mode by adding a comma-separated list of class names to the
pa.fips.additionalAllowedProviders
property.Example:
pa.fips.additionalallowedproviders=X,Y
-
(Optional) Add or remove TLS protocols by editing the
pa.fips.tls.protocols
property to include a comma-separated list of valid TLS protocols.The default is:
pa.fips.tls.protocols = TLSv1.2
-
(Optional) Add or remove TLS cipher suites by editing the
pa.fips.tls.ciphers
property to include a comma-separated list of valid TLS cipher suites.The default is:
pa.fips.tls.ciphers = TLS_AES_256_GCM_SHA384, \ TLS_AES_128_GCM_SHA256, \ TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, \ TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, \ TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, \ TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, \ TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, \ TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, \ TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, \ TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, \ TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384, \ TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384, \ TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, \ TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, \ TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384, \ TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384, \ TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, \ TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256, \ TLS_EMPTY_RENEGOTIATION_INFO_SCSV
Some of the default cipher suites aren’t supported by every JDK version that can be used with PingAccess. If a TLS cipher suite isn’t supported by the JDK version you’re using, PingAccess will log a warning in the
pingaccess.log
file when the cipher suite is invoked.PingAccess can ignore any flagged TLS cipher suites with no performance impact. To clear the warning message, you can remove the flagged suites from the
pa.fips.tls.ciphers
property. -
Save and close the
<PA Home>/conf/fips-mode.properties
file. -
If you’re running PingAccess as a Windows service, reconfigure the classpath for the libraries required for FIPS mode:
-
Comment out the following line:
set.default.BC_PATH=../../resource/bc/non-fips
-
Uncomment the following line or set a
BC_PATH
environment variable to../../resource/bc/fips
:# set.default.BC_PATH=../../resource/bc/fips
Learn more in the inline comments in the
<PA_HOME>/sbin/windows/PingAccessService.conf
file. -
-
Restart PingAccess.