Configure FIPS mode in Service Request Catalog (SRC)

In SRC, you need to perform the following tasks to enable the implementation of FIPS validated TLS connections between the Service Manager Server and SRC, and between SRC and the Solr Search Engine.

Prerequisites

Before you proceed, make sure of the following:

1. You have already configured SRC's JRE for FIPS mode. For details, see the Service Request Catalog (SRC) section in Configure Java for FIPS mode.

2. You have already generated a CA certificates file and a client keystore for the SRC host and Solr Search Engine host. For details, see Generate FIPS validated certificates for the SM Server and other components.

   • The CA certificates file: \certs\smcacerts.p12
   • The SRC keystore file: \key\sun-sun-<SRC host FQDN>.p12 (for example, sun-sun-srchost.mycompany.net.p12)
   • The Solr Search Engine keystore file: \key\sun-sun-<Solr Search Engine host FQDN>.p12 (for example,sun-sun-solrhost.mycompany.net.p12)

   Note The following tasks assume that your SRC keystore and Solr Search Engine keystore are issued by the same root CA.

3. You have enabled FIPS mode on the SM Server side. For details, see Configure FIPS mode in the Server.

Task 1: Configure FIPS mode for TLS connections between the SM Server and SRC

Follow these steps:

1. Copy the certificate files to a directory on the SRC host.

   For example, C:\client.

2. Configure the parameters in SRC's applicationContext.property file, which is located in the <SRC .war file>\WEB-INF\classes directory, as shown in the following:

   sm.hostname=smserver.mycompany.net 
   sm.port=13443
   sm.protocol=https
   src.trustStore=C:\\client\\smcacerts.p12
   src.trustStorePassword=changeit
   src.trustStoreType=pkcs12  
   src.keyStore=C:\\client\\sun-sun-srchost.mycompany.net.p12
   src.keyStorePassword=clientkeystore
   src.keyStoreType=pkcs12

   • For sm.hostname, FIPS mode requires the use of the fully qualified domain name (FQDN) of the Service Manager Server host.
   • The default value for the sm.protocol parameter is http. You need to change it to https for FIPS mode.
   • The src.trustStoreType and src.keyStoreType parameters are not included in the out-of-box version of this file. You must manually insert them with a value of pkcs12, which is the only supported certificate type when Service Manager is running in FIPS mode.
   • The rest of the parameter values are for example only; change the values according to your own configuration.
   • The file paths must use double backslashes.
3. Make sure the SM Server is started.
4. Restart the SRC Tomcat.

5. Log in to SRC.

   If FIPS mode has been enabled successfully in SRC, you should be logged in successfully.

   Note If you need to enable LW-SSO in SRC when it is running in FIPS mode, see Configure LW-SSO in SRC for FIPS mode.

Task 2: Configure FIPS mode for TLS connections between SRC and Solr

Since your SRC keystore and Solr Search Engine keystore are issued by the same root CA, no additional configuration steps are required on the SRC side. Once FIPS mode is enabled in SRC, you only need to enable FIPS mode in the Solr Search Engine. For detailed steps, see Configure FIPS mode in the Solr Search Engine.

keytool -import -keystore smcacerts.p12 -trustcacerts -alias ibmca -file ibmca.crt -storepass changeit -storetype pkcs12

Next step:

Configure FIPS mode in the Solr Search Engine