Configure properties in Java security file

Edit the Java security file for the JRE to add additional security providers and configure properties for FIPS 140-2 compliance. Open the CSA_JRE_HOME\lib\security\java.security file in an editor (where

certificate_key_file is the same keystore file defined by the certificate-key-file attribute in the ssl element of the CSA_HOME\jboss-as\standalone\
configuration\standalone.xml file (for example, CSA_HOME\jboss-as\
standalone\configuration\.keystore).

certificate_key_file_password is the password to the keystore file.

certificate_key_file_type is the keystore type (for example, JKS or PKCS12).

1. For every provider listed (in the format security.provider.<nn>=<provider_name>), increment the preference order number (<nn>) by one. For example, change a provider entry from security.provider.1=sun.security.provider.Sun to security.provider.2=sun.security.provider.Sun.

2. Add a new default provider (RSA JCE). Add the following provider to the top of the provider list:

   security.provider.1=com.rsa.jsafe.provider.JsafeJCE

3. Update the SunJSSE provider to use packages that are compliant with FIPS 140-2.

   For example, change the following entry from:

   security.provider.<nn>=com.sun.net.ssl.internal.ssl.Provider

   to

   security.provider.<nn>=com.sun.net.ssl.internal.ssl.Provider JsafeJCE

4. Set the default keystore type to PKCS #12. Edit or add the following entry:

   keystore.type=PKCS12

5. Add the following entry to ensure RSA BSAFE is used in FIPS 140-2 compliant mode:

   com.rsa.cryptoj.fips140initialmode=FIPS140_SSL_MODE

6. Set the default random number generation algorithm to HMAC DRBG with 128-bit security strength:

   com.rsa.crypto.default.random = HMACDRBG128

7. Exit and save the java.security file.