Configure FIPS mode in the Chat Server

Prerequisites

Before you proceed, make sure of the following:

1. Your chat server is running in FIPS mode. For details, see the Openfire Chat Server section in Configure Java for FIPS mode.

2. You have already generated a CA certificates file and a client keystore for the Chat Server host. For details, see Generate FIPS validated certificates for the SM Server and other components.

   • The CA certificates file: \certs\smcacerts.p12

   • The Server's trusted clients keystore file: \certs\trustedclients.p12

   • The Server keystore file: \key\sun-server-chatserver.mycompany.net.p12
3. You have enabled FIPS mode on the SM Server side. For details, see Configure FIPS mode in the Server.

Follow these steps to enable FIPS mode in the Chat Server:

1. Log in to your Openfire Administration Console, and then click Server > Server Manager > System Properties. Alternatively, access https://localhost:9091/server-properties.jsp.

2. Add the following properties:

   Property Name	Property Value
   xmpp.socket.ssl.storeType	PKCS12
   xmpp.socket.ssl.client.trustpass	<password of PKCS12 trust store>
   xmpp.socket.ssl.keypass	<password of PKCS12 keystore>

3. Copy the certificate files (smcacerts.p12, trustedclients.p12, and sun-server-chatserver.mycompany.net.p12) to the <chat server>\\resources\security folder, and then rename these fields as follows:

   • Rename smcacerts.p12 to truststore

   • Rename trustedclients.p12to client.truststore

   • Rename sun-server-chatserver.mycompany.net.p12 to keystore

4. Open the chat server configuration file (<chat server>\conf\openfire.xml) in a text editor.

5. Locate the <securityConfig> section, and then set the fipsmode paramter to true (default: false), as shown in the following.

   <fipsmode>true</fipsmode>  
   <JCEProviderName>JsafeJCE</JCEProviderName>          
   <JCEProviderClassName>com.rsa.jsafe.provider.JsafeJCE</JCEProviderClassName>

6. Save your changes and close this file.

7. Restart the Chat Service for your configuration to take effect.

Next step:

Configure FIPS mode in the Chat Service