Introduction  JSSE configuration

Chapter 6: Using TLS and FIPS

SSL/TLS and FIPS support

EAServer security includes support for SSL, certificate handling, and TLS, including:

  1. keytool – a command line tool used to configure and modify the certificate database, generate certificate requests, and so on. See “Managing keys and certificates on EAServer” for more information.

  2. set-certificate – a command line script used to map certificates to users. See “Set-certificate” for more information.

  3. Two implementations for handling SSL/TLS protocol and related ciphersuites:

StepsEnabling FIPS using the Certicom Java libraries

FIPS mode requires Certicom Java 1.4 libraries to be installed and running.

When FIPS mode is enabled, any SSL listener not using a FIPS-supported security profile is considered invalid, and does not start. See “Security characteristics” for a list.

  1. On the server – from the Web Management Console, select FIPS Mode Enabled for the server on which you are enabling FIPS. See “JSSE configuration” for instructions.

    If you set the “-fips false” option, the server is started using the JSSE library.

    With FIPS enabled, you can use only certain algorithms (security characteristics) for quality of protection (QOP). See “Security characteristics” for a list.

  2. On the client – set the com.sybase.ejb.fips connection property to specify FIPS usage. Additional client-side properties added to support FIPS include:

    With FIPS enabled, typical client code used to access an EJB on the server could look like:

    Properties props = new Properties();
props.put(Context.INITIAL_CONTEXT_FACTORY, “com.sybase.ejb.InitialContextFactory”);
props.put(Context.PROVIDER_URL, “iiops://” + “localhost” + “:” + port1);
props.put(Context.SECURITY_PRINCIPAL, “admin@system”);
props.put(Context.SECURITY_CREDENTIALS, “sybase1”);
props.put(“com.sybase.ejb.qop”, “intl”);
Context ctx = new InitialContext(props);
Object obj = ctx.lookup(“ejb”);

NoteJMS clients For JMS clients, set the com.sybase.jms.fips connection property to specify FIPS usage. Additional client-side properties added to support FIPS are the same as mentioned above for EJBs, except the property names use jms instead of ejb. For example, com.sybase.ejb.keystore becomes com.sybase.jms.keystore. You also need the proper Java libraries in the classpath, namely under the lib/fips/ subdirectory.

If FIPS mode is enabled, EAServer logs the message FIPS 140-2 mode enabled to the console. If the mode is not set, no message is logged.

Enabling FIPS has the following effect on EAServer:

For FIPS certification:




Copyright © 2006. Sybase Inc. All rights reserved. JSSE configuration

View this document as PDF