Configure Properties in the Java Security File

Edit the Java security file for the JRE to add additional security providers and configure properties for FIPS 140-2 compliance. Open the <csa_jre>\lib\security\java.security file in an editor (where <csa_jre> is the directory in which the JRE that is used by CSA is installed.) and do the following:

1. For every provider listed (in the format security.provider.<nn>=<provider_name>), increment the preference order number (<nn>) by one. For example, change a provider entry from :

   security.provider.1=sun.security.provider.Sun

   to

   security.provider.2=sun.security.provider.Sun.

2. Add a new default provider (RSA JCE). Add the following provider to the top of the provider list:

   security.provider.1=com.rsa.jsafe.provider.JsafeJCE

3. Update the SunJSSE provider to use packages that are compliant with FIPS 140-2.

   For example, change the following entry from:

   security.provider.<nn>=com.sun.net.ssl.internal.ssl.Provider

   to

   security.provider.<nn>=com.sun.net.ssl.internal.ssl.Provider JsafeJCE

4. Set the default keystore type to PKCS #12. Edit or add the following entry:

   keystore.type=PKCS12

5. Add the following entry to ensure RSA BSAFE is used in FIPS 140-2 compliant mode:

   com.rsa.cryptoj.fips140initialmode=FIPS140_SSL_MODE

6. Set the default random number generation algorithm to HMAC DRBG with 128-bit security strength:

   com.rsa.crypto.default.random = HMACDRBG128

7. Exit and save the java.security file.