Configure FIPS mode in the Chat Server

Prerequisites

Before you proceed, make sure of the following:

Search for	Example	Results
A single word	`cat`	Topics that contain the word "cat". You will also find its grammatical variations, such as "cats".
A phrase. You can specify that the search results contain a specific phrase.	`"cat food"` (quotation marks)	Topics that contain the literal phrase "cat food" and all its grammatical variations. Without the quotation marks, the query is equivalent to specifying an OR operator, which finds topics with one of the individual words instead of the phrase.

Search for	Operator	Example
Two or more words in the same topic	`AND` `and` `+` (plus symbol) `&` (ampersand)	`cat AND dog` `"cat food"+milk` `"cat food"&"dog food"`
Either word in a topic	`OR` `or` `\|` (pipe)	`cat OR dog` `cat \| dog`
Topics that do not contain a specific word or phrase	`NOT` `not` `!` (exclamation point)	`NOT cat` `! dog`
Topics that contain one string and do not contain another	`^` (caret)	`cat ^ mouse`
A combination of search types	`( )` parentheses	`cat + (dog \| mouse)` `cat \| dog + (! mouse)`

Your chat server is running in FIPS mode. For details, see the Openfire Chat Server section in Configure Java for FIPS mode.

You have already generated a CA certificates file and a client keystore for the Chat Server host. For details, see Generate FIPS validated certificates for the SM Server and other components.

The CA certificates file: \certs\smcacerts.p12
The Server's trusted clients keystore file: \certs\trustedclients.p12
The Server keystore file: \key\sun-server-chatserver.mycompany.net.p12

You have enabled FIPS mode on the SM Server side. For details, see Configure FIPS mode in the Server.

Follow these steps to enable FIPS mode in the Chat Server:

Log in to your Openfire Administration Console, and then click Server > Server Manager > System Properties. Alternatively, access https://localhost:9091/server-properties.jsp.

Add the following properties:

Property Name	Property Value
xmpp.socket.ssl.storeType	PKCS12
xmpp.socket.ssl.client.trustpass	<password of PKCS12 trust store>
xmpp.socket.ssl.keypass	<password of PKCS12 keystore>

Copy the certificate files (smcacerts.p12, trustedclients.p12, and sun-server-chatserver.mycompany.net.p12) to the <chat server>\\resources\security folder, and then rename these fields as follows:

Rename smcacerts.p12 to truststore
Rename trustedclients.p12to client.truststore
Rename sun-server-chatserver.mycompany.net.p12 to keystore

Open the chat server configuration file (<chat server>\conf\openfire.xml) in a text editor.

Locate the <securityConfig> section, and then set the fipsmode paramter to true (default: false), as shown in the following.

<fipsmode>true</fipsmode>  
<JCEProviderName>JsafeJCE</JCEProviderName>          
<JCEProviderClassName>com.rsa.jsafe.provider.JsafeJCE</JCEProviderClassName>

Save your changes and close this file.

Restart the Chat Service for your configuration to take effect.

Next step: