Search code examples
ssltomcatbouncycastlefips

Configuring embedded Tomcat to serve FIPS-compliant HTTP2 with BouncyCastle

I'm trying to configure an embedded Tomcat server so that it can serve HTTP2 in FIPs mode, using BouncyCastle's FIPs libraries. I've set the accepted protocols to TLSv1.2+TLSv1.3. I've tried various suggested cipher suites, but it seems no matter what I set as the cipher suite, Chrome/FF rejects connections on the grounds of "Inadequate Security". If I disable HTTP2, it does not matter what I set as the cipher suite - it just works.

I'm a bit confused.

Solution

  • When BC is in FIPS mode, it requires PKIX as algorithm for the KeyManagerFactory and TrustManagerFactory:

    Security.setProperty("ssl.KeyManagerFactory.algorithm", "PKIX");
Security.setProperty("ssl.TrustManagerFactory.algorithm", "PKIX");

    Without these two lines the server will be unable to retrieve the keys required by the cipher suite.