9.1 Procedure

  1. Create a new folder for FIPS. Example: C:\fips

  2. Take a backup of the following files in the newly created folder:

    Files

    Existing file path

    idm.jks

    C:\netiq\idm\apps\tomcat\conf

    osp.jks

    tomcat.ks

    encrypt-keys.pkcs12

    server.xml

    ism-configuration.properties

    configupdate.bat

    C:\netiq\idm\apps\configupdate

    configupdate.bat.properties

  3. Navigate to <mount location>\common\osp\misc and copy osp-tomcat8-pwd-handler-<version>.jar to C:\netiq\idm\apps\tomcat\lib folder.

  4. Navigate to the C:\NetIQ\IDM\apps\tomcat\bin\ folder and edit the setenv.bat file as follows:

    • set JAVA_OPTS= %JAVA_OPTS% -Dorg.bouncycastle.fips.approved_only=true -Dinternal.osp.framework.fips-password=novell -Dorg.bouncycastle.rsa.allow_multi_use=true -Djavax.net.ssl.keyStoreType=BCFKS -Djavax.net.ssl.trustStoreType=BCFKS -Djavax.net.ssl.trustStore=c:\netiq\idm\apps\tomcat\conf\idm.bcfks -Djavax.net.ssl.trustStorePassword=novell

    • set BCFIPS_JARS=c:\netiq\common\jre\lib\bc-fips-1.0.2.5.jar;c:\netiq\common\jre\lib\bcpkix-fips-1.0.7.jar;c:\netiq\common\jre\lib\bctls-fips-1.0.19.jar

    • set CLASSPATH=C:\NetIQ\Common\JRE\lib\bc-fips-1.0.2.5.jar;C:\NetIQ\Common\JRE\lib\bcpkix-fips-1.0.7.jar;C:\NetIQ\Common\JRE\lib\bctls-fips-1.0.19.jar;%CLASSPATH%

    • Search for CATALINA_OPTS and change encrypt-keys.pkcs12 to encrypt-keys.bcfks and storetype to bcfks

    NOTE:Make sure the set JAVA_OPTS, set BCFIPS_JARS, and set CLASSPATH values are placed before CATALINA_OPTS.

  5. In the command prompt, navigate to the C:\NETIQ\Commom\JRE\bin and run the following commands:

    keytool -importkeystore -srckeystore C:\NetIQ\IDM\apps\tomcat\conf\idm.jks -srcstorepass novell -srcstoretype PKCS12 -destkeystore C:\NetIQ\IDM\apps\tomcat\conf\idm.bcfks -deststorepass novell -deststoretype BCFKS -providerclass  org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider -providerpath $CLASSPATH
    keytool -importkeystore -srckeystore C:\NetIQ\IDM\apps\tomcat\conf\tomcat.ks -srcstorepass -srcstoretype PKCS12 -destkeystore C:\NetIQ\IDM\apps\tomcat\conf\tomcat.bcfks -deststorepass -deststoretype BCFKS -providerclass  org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider -providerpath $CLASSPATH
    keytool -importkeystore -srckeystore C:\NetIQ\IDM\apps\tomcat\conf\idm.jks -srcstorepass novell -srcstoretype PKCS12 -destkeystore C:\NetIQ\IDM\apps\osp\osp.bcfks -deststorepass novell -deststoretype BCFKS -providerclass  org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider -providerpath $CLASSPATH
    keytool -importkeystore -srckeystore C:\NetIQ\IDM\apps\tomcat\conf\tomcat.ks -srcstorepass changeit -srcstoretype PKCS12 -destkeystore C:\NetIQ\IDM\apps\osp\osp.bcfks -deststorepass novell -deststoretype BCFKS -providerclass  org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider -providerpath $CLASSPATH
    java -jar <mount-location>\common\osp\misc\osp-keymanager-6.7.7.jar -genkeys -keystore C:\NetIQ\IDM\apps\osp\osp.bcfks -storepass novell -storetype BCFKS -application idm -providerClass org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider -providerPath C:\NetIQ\Common\JRE\lib\bc-fips-1.0.2.5.jar -keypass novell -use Encrypting,Signing,TLS
    keytool -importkeystore -srckeystore C:\NetIQ\IDM\apps\tomcat\conf\encrypt-keys.pkcs12 -srcstorepass changeit -srcstoretype PKCS12 -destkeystore C:\NetIQ\IDM\apps\tomcat\conf\encrypt-keys.bcfks -deststorepass changeit -deststoretype BCFKS -providerclass  org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider -providerpath $CLASSPATH

  6. Edit the server.xml file as follows:

    <!--Connector port="8543" protocol="org.apache.coyote.http11.Http11NioProtocol" maxThreads="150" SSLEnabled="true" scheme="https" secure="true" clientAuth="false" sslProtocol="TLSv1.3" keystoreFile="conf/tomcat.ks" keystorePass="changeit" maxHttpHeaderSize="65536" sslEnabledProtocols="TLSv1.3" /-->

<Connector protocol="com.microfocus.osp.tomcat.http.PasswordHttp11NioProtocol" port="8543" maxThreads="150" maxHttpHeaderSize="65536" SSLEnabled="true" scheme="https" secure="true">

<SSLHostConfig protocol="TLS" protocols="TLSv1.3" ciphers="TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,TLS_DHE_DSS_WITH_AES_256_GCM_SHA384,TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,TLS_DHE_DSS_WITH_AES_128_CBC_SHA,TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,TLS_DHE_DSS_WITH_AES_256_CBC_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_CCM,TLS_RSA_WITH_AES_256_CCM,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA" truststoreFile="C:\NetIQ\IDM\apps\osp\osp.bcfks" truststorePassword="novell" truststoreType="BCFKS" >

<Certificate certificateKeystoreFile="C:\NetIQ\IDM\apps\tomcat\conf\tomcat.bcfks" certificateKeystorePassword="novell" certificateKeyAlias="ssl certificatedns" certificateKeystoreType="BCFKS" />

</SSLHostConfig>
</Connector>

  7. Edit the ism-configuration.properties file as follows:

    com.netiq.idm.osp.ssl-keystore.file = C:\\NetIQ\\IDM\\\\apps\\\\tomcat\\\\conf\\\\tomcat.bcfks
    com.netiq.idm.osp.ssl-keystore.type = BCFKS
    com.netiq.idm.osp.oauth-keystore.file = C:\\\\NetIQ\\\\IDM\\\\apps\\\\osp\\\\osp.bcfks
    com.netiq.idm.osp.oauth-keystore.type = BCFKS
    com.netiq.rpt.ssl-keystore.file = C:\\NetIQ\\IDM\\apps\\tomcat\\conf\\idm.bcfks
    com.netiq.rpt.ssl-keystore.type = BCFKS
    DirectoryService/realms/jndi/params/KEYSTORE_PATH = C:\\NetIQ\\IDM\\apps\\tomcat\\conf\\idm.bcfks
    com.sssw.fw.security.sigcert.truststore.type = BCFKS
    com.netiq.idm.osp.oauth-truststore.file = C:\\\\NetIQ\\\\IDM\\\\apps\\\\tomcat\\\\conf\\\\idm.bcfks
    com.netiq.idm.ua.ldap.keystore-type = BCFKS
    com.netiq.idm.osp.oauth-key-alias = ssl certificatedns

  8. Copy the following jars to the C:\NetIQ\IDM\apps\configupdate\lib folder:

    • bc-fips-1.0.2.5.jar

    • bcpkix-fips-1.0.7.jar

    • bctls-fips-1.0.19.jar

  9. Edit the following in C:\NetIQ\IDM\apps\configupdate.bat.properties:

    master_keystore_type=bcfks
master_keystore=C:\NetIQ\IDM\apps\tomcat\conf\encrypt-keys.bcfks

  10. Edit the following in configupdate.bat:

    set "JAVA_OPTS= %JAVA_OPTS% -Dorg.bouncycastle.fips.approved_only=true -Dinternal.osp.framework.fips-password=novell -Dorg.bouncycastle.rsa.allow_multi_use=true -Djavax.net.ssl.keyStoreType=BCFKS -Djavax.net.ssl.trustStoreType=BCFKS -Djavax.net.ssl.trustStore=c:\netiq\idm\apps\tomcat\conf\idm.bcfks -Djavax.net.ssl.trustStorePassword=novell  "
    set CLASSPATH=C:\NetIQ\Common\JRE\lib\bc-fips-1.0.2.5.jar;C:\NetIQ\Common\JRE\lib\bcpkix-fips-1.0.7.jar;C:\NetIQ\Common\JRE\lib\bctls-fips-1.0.19.jar;%CLASSPATH%

  11. Launch the configupdate utility.

  12. Start Tomcat.