4

I've built openssl-fips, openssl, and tc-native (Tomcat Native Library) and pointed Tomcat at the native library. I see APR started in the logs:

13-Nov-2014 14:01:32.197 INFO [main] org.apache.catalina.core.AprLifecycleListener.init Loaded APR based Apache Tomcat Native library 1.1.32 using APR version 1.3.9.
13-Nov-2014 14:01:32.197 INFO [main] org.apache.catalina.core.AprLifecycleListener.init APR capabilities: IPv6 [true], sendfile [true], accept filters [false], random [true].
13-Nov-2014 14:01:32.431 INFO [main] org.apache.catalina.core.AprLifecycleListener.initializeSSL OpenSSL successfully initialized (OpenSSL 1.0.1j 15 Oct 2014)
13-Nov-2014 14:01:32.712 INFO [main] org.apache.coyote.AbstractProtocol.init Initializing ProtocolHandler ["http-apr-443"]

I can get to the site using https://localhost/ and the cert looks like it's correct. Firefox looks the same when I look at the site security information and compare the before-FIPS and after-FIPS setup:

enter image description here

The questions are:

  1. How can I verify that the communication between the browser and server is actually FIPS 140-2 compliant?
  2. Is there any way to force FIPS-only communication on the server end?
Chris Williams
  • 11,647
  • 15
  • 60
  • 97

1 Answers1

4

It may not be obvious, but this isn't a <Connector> option, but instead an APR option which gets configured in the APRLifecycleListener in CATALINA_BASE/conf/server.xml.

You can read the documentation for the APRLifecycleListener and see that there is a FIPSMode setting that allows you to control the use of FIPS mode. I think you want FIPSMode="on".

This will force Tomcat (really OpenSSL) to operate in a FIPS-compliant manner. The client has no effect on this, and will therefore have to conform to the server's (FIPS-compliant) behavior.

Christopher Schultz
  • 20,221
  • 9
  • 60
  • 77
  • FWIW, FIPS-140-2 is pretty much irrelevant, though I know lots of people running US-government-related services are required to adhere to it. I personally don't believe FIPS-compliance buys you anything at all above and beyond what you get from any decent crypto library. – Christopher Schultz Nov 13 '14 at 19:34
  • Hmm. I'll take a look at the APR options in the APRLifecycleListener. Thanks. – Chris Williams Nov 13 '14 at 19:47
  • 1
    After enabling this option, I now see: "Initializing FIPS mode..." and "Successfully entered FIPS mode" – Chris Williams Nov 13 '14 at 20:16