18.11 Post-Upgrade Tasks in FIPS-enabled Mode

After upgrading OpenText Identity Manager in FIPS-enabled mode:

Make sure to convert JKS format Java keystores to BCFKS format.

For example, in the ism-configuration.properties file, change the following properties from JKS to BCFKS format:

com.sssw.fw.security.sigcert.truststore.path = /opt/netiq/idm/apps/tomcat/conf/idm.bcfkscom.netiq.idm.ua.ldap.edit.keystore-type = BCFKScom.netiq.idm.ua.ldap.edit.keystore-type.other = BCFKScom.netiq.idm.osp.oauth-truststore.file = /opt/netiq/idm/apps/tomcat/conf/idm.bcfksDirectoryService/realms/jndi/params/KEYSTORE_PATH = /opt/netiq/idm/apps/tomcat/conf/idm.bcfkscom.netiq.rpt.ssl-keystore.file = /opt/netiq/idm/apps/tomcat/conf/idm.bcfks
Make sure to update the customization in the java.security file located in the <jre-root>/conf/security directory by executing the following steps:
1. Search for the list of providers and their preference orders string, comment all the existing providers, and then add the following entries:
```
security.provider.1=BCFIPS
security.provider.2=BCJSSE
security.provider.3=SunJSSE
security.provider.4=SUN
security.provider.5=SunJCE
```
2. Search for the ssl.KeyManagerFactory.algorithm=SunX509 string, comment it, and then add:
```
ssl.KeyManagerFactory.algorithm=PKIX
```
3. Search for the keystore.type string, comment it, and then add:
```
keystore.type=bcfks
```