diff --git openjdk.orig/src/java.base/share/classes/module-info.java openjdk/src/java.base/share/classes/module-info.java

index 5460efcf8c..f08dc2fafc 100644

--- openjdk.orig/src/java.base/share/classes/module-info.java

+++ openjdk/src/java.base/share/classes/module-info.java

@@ -182,6 +182,7 @@ module java.base {

         java.security.jgss,

         java.sql,

         java.xml,

+        jdk.crypto.cryptoki,

         jdk.jartool,

         jdk.attach,

         jdk.charsets,

diff --git openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java

index 099caac605..ffadb43eb1 100644

--- openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java

+++ openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java

@@ -43,6 +43,8 @@ import javax.security.auth.callback.PasswordCallback;

 import com.sun.crypto.provider.ChaCha20Poly1305Parameters;

 import jdk.internal.misc.InnocuousThread;

+import jdk.internal.misc.SharedSecrets;

+

 import sun.security.util.Debug;

 import sun.security.util.ResourcesMgr;

 import static sun.security.util.SecurityConstants.PROVIDER_VER;

@@ -60,6 +62,9 @@ import static sun.security.pkcs11.wrapper.PKCS11Constants.*;

  */

 public final class SunPKCS11 extends AuthProvider {

+    private static final boolean systemFipsEnabled = SharedSecrets

+            .getJavaSecuritySystemConfiguratorAccess().isSystemFipsEnabled();

+

     private static final long serialVersionUID = -1354835039035306505L;

     static final Debug debug = Debug.getInstance("sunpkcs11");

@@ -376,6 +381,24 @@ public final class SunPKCS11 extends AuthProvider {

             if (nssModule != null) {

                 nssModule.setProvider(this);

             }

+            if (systemFipsEnabled) {

+                // The NSS Software Token in FIPS 140-2 mode requires a user

+                // login for most operations. See sftk_fipsCheck. The NSS DB

+                // (/etc/pki/nssdb) PIN is empty.

+                Session session = null;

+                try {

+                    session = token.getOpSession();

+                    p11.C_Login(session.id(), CKU_USER, new char[] {});

+                } catch (PKCS11Exception p11e) {

+                    if (debug != null) {

+                        debug.println("Error during token login: " +

+                                p11e.getMessage());

+                    }

+                    throw p11e;

+                } finally {

+                    token.releaseSession(session);

+                }

+            }

         } catch (Exception e) {

             if (config.getHandleStartupErrors() == Config.ERR_IGNORE_ALL) {

                 throw new UnsupportedOperationException