Search code examples
javasecuritysslfips

Disable HTTPS Certificate Validation in FIPS mode

There is a code in java which performs HTTPS call and then ignores the incoming certificate validation. In order to do this the custom trust manager is implemented. But now we need to switch to FIPS mode. And in fips mode the following exception is received when the custom trustmanager is used by SSL Socket.

FIPS mode: only SunJSSE TrustManagers may be used

So is there a way to bypass the incoming certificate verification in a FIPS mode?

Solution

  • You are basically asking if you can enable a specific security level (FIPS) while disabling some of the security required in this level. No - the whole point of this security level is to ensure that specific security requirements are met, and proper certificate validation is an essential requirement.