|
 |
cdbd41 |
diff -r 6efbd7b35a10 src/share/classes/java/security/SystemConfigurator.java
|
|
|
cdbd41 |
--- openjdk.orig/jdk/src/share/classes/java/security/SystemConfigurator.java Thu Jan 23 18:22:31 2020 -0300
|
|
|
cdbd41 |
+++ openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java Mon Mar 02 19:20:17 2020 -0300
|
|
|
cdbd41 |
@@ -123,6 +123,33 @@
|
|
|
cdbd41 |
}
|
|
|
cdbd41 |
props.put(fipsProviderKey, fipsProviderValue);
|
|
|
cdbd41 |
}
|
|
|
cdbd41 |
+ // Add other security properties
|
|
|
cdbd41 |
+ String keystoreTypeValue = (String) props.get("fips.keystore.type");
|
|
|
cdbd41 |
+ if (keystoreTypeValue != null) {
|
|
|
cdbd41 |
+ String nonFipsKeystoreType = props.getProperty("keystore.type");
|
|
|
cdbd41 |
+ props.put("keystore.type", keystoreTypeValue);
|
|
|
cdbd41 |
+ if (keystoreTypeValue.equals("PKCS11")) {
|
|
|
cdbd41 |
+ // If keystore.type is PKCS11, javax.net.ssl.keyStore
|
|
|
cdbd41 |
+ // must be "NONE". See JDK-8238264.
|
|
|
cdbd41 |
+ System.setProperty("javax.net.ssl.keyStore", "NONE");
|
|
|
cdbd41 |
+ }
|
|
|
cdbd41 |
+ if (System.getProperty("javax.net.ssl.trustStoreType") == null) {
|
|
|
cdbd41 |
+ // If no trustStoreType has been set, use the
|
|
|
cdbd41 |
+ // previous keystore.type under FIPS mode. In
|
|
|
cdbd41 |
+ // a default configuration, the Trust Store will
|
|
|
cdbd41 |
+ // be 'cacerts' (JKS type).
|
|
|
cdbd41 |
+ System.setProperty("javax.net.ssl.trustStoreType",
|
|
|
cdbd41 |
+ nonFipsKeystoreType);
|
|
|
cdbd41 |
+ }
|
|
|
cdbd41 |
+ if (sdebug != null) {
|
|
|
cdbd41 |
+ sdebug.println("FIPS mode default keystore.type = " +
|
|
|
cdbd41 |
+ keystoreTypeValue);
|
|
|
cdbd41 |
+ sdebug.println("FIPS mode javax.net.ssl.keyStore = " +
|
|
|
cdbd41 |
+ System.getProperty("javax.net.ssl.keyStore", ""));
|
|
|
cdbd41 |
+ sdebug.println("FIPS mode javax.net.ssl.trustStoreType = " +
|
|
|
cdbd41 |
+ System.getProperty("javax.net.ssl.trustStoreType", ""));
|
|
|
cdbd41 |
+ }
|
|
|
cdbd41 |
+ }
|
|
|
cdbd41 |
loadedProps = true;
|
|
|
cdbd41 |
}
|
|
|
cdbd41 |
} catch (Exception e) {
|
|
|
cdbd41 |
diff -r 6efbd7b35a10 src/share/lib/security/java.security-linux
|
|
|
cdbd41 |
--- openjdk.orig/jdk/src/share/lib/security/java.security-linux Thu Jan 23 18:22:31 2020 -0300
|
|
|
cdbd41 |
+++ openjdk/jdk/src/share/lib/security/java.security-linux Mon Mar 02 19:20:17 2020 -0300
|
|
|
cdbd41 |
@@ -179,6 +179,11 @@
|
|
|
cdbd41 |
keystore.type=jks
|
|
|
cdbd41 |
|
|
|
cdbd41 |
#
|
|
|
cdbd41 |
+# Default keystore type used when global crypto-policies are set to FIPS.
|
|
|
cdbd41 |
+#
|
|
|
cdbd41 |
+fips.keystore.type=PKCS11
|
|
|
cdbd41 |
+
|
|
|
cdbd41 |
+#
|
|
|
cdbd41 |
# Controls compatibility mode for the JKS keystore type.
|
|
|
cdbd41 |
#
|
|
|
cdbd41 |
# When set to 'true', the JKS keystore type supports loading
|