Openfire 4.4.4 is not starting with bouncycastle fips provider

Openfire Openfire Support
1

Openfire 4.4.4 version is not starting with bouncycastlefips provider.

Below are the security providers I used for openfire

security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
security.provider.2=org.bouncycastle.jsse.provider.BouncyCastleJsseProvider BCFIPS
security.provider.3=com.rsa.jsafe.provider.JsafeJCE
security.provider.4=sun.security.provider.Sun
security.provider.5=com.sun.net.ssl.internal.ssl.Provider
security.provider.6=com.rsa.jsse.JsseProvider

Also used below jar files in the classpath
bcprov-jdk15on-165.jar, bc-fips-1.0.2.jar, bctls-jdk15on-164.jar , bcpkix-jdk15on-1.63.jar

In the openfire code there is default intitalization of BouncyCastleProvider(org.bouncycastle.jce.provider.BouncyCastleProvider) in org.jivesoftware.util.AesEncryptor. It seems due to this only bouncycastlejsse and fips are not working.

There is no error found in any of the logs.

Is there any way to start openfire with those security providers.

2

Is there a plan to address this issue ?

3

There are no plans that I know if to make the security providers used by Openfire configurable. Can you motivate the request? Iā€™m interested in the use cases for this.

4

Hi @guus, how about a user who wants to configure a FIPS-compliant security provider such as bc-fips?

5

I have raised a new ticket in our issue tracker for this: [OF-2593] - Ignite Realtime Jira

1 Like