[jboss-jira] [JBoss JIRA] (ELY-1618) TLS with BCJSSE Provider does not work

[ https://issues.jboss.org/browse/ELY-1618?page=com.atlassian.jira.plugin.s... ] Martin Choma updated ELY-1618: ------------------------------ Steps to Reproduce: * drop two bc fips jars into java.home/jre/lib/ext ** bc-fips-1.0.1.jar ** bctls-fips-1.0.5.jar * install bc fips in java.security {code} security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider security.provider.2=org.bouncycastle.jsse.provider.BouncyCastleJsseProvider fips:BCFIPS security.provider.3=sun.security.provider.Sun {code} * remove openssl provider from standalone.xml ** /subsystem=elytron:write-attribute(name=final-providers,value=elytron) * create BCFKS keystore ** keytool, -genkeypair, -alias, appserver, -keyalg, RSA, -keysize, 2048, -keypass, password, -keystore, /home/mchoma/git-repo/tests-security/fips/target/bc-workdir/keystore.bcfks, -provider, org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider, -providerpath, /home/mchoma/.m2/repository/org/bouncycastle/fips/bc-fips/1.0.1/bc-fips-1.0.1.jar, -storetype, BCFKS, -storepass, password, -dname, CN=appserver,OU=QE,O=Redhat,L=Brno,ST=CR,C=CZ, -validity, 730, -v * configure undertow with tls **/subsystem=elytron/key-store=key-store-name_server-ssl-context:add(name=key-store-name_server-ssl-context, type=BCFKS, credential-reference={clear-text => password}, path=/home/mchoma/git-repo/tests-security/fips/target/bc-workdir/keystore.bcfks **/subsystem=elytron/key-manager=key-manager-name_server-ssl-context:add(key-store=key-store-name_server-ssl-context, credential-reference={clear-text => password}, algorithm=X509) **/subsystem=elytron/server-ssl-context=server-ssl-context:add(key-manager=key-manager-name_server-ssl-context, cipher-suite-filter=TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,TLS_DHE_DSS_WITH_AES_128_CBC_SHA,TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,TLS_DHE_DSS_WITH_AES_256_CBC_SHA,TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA256, protocols=[TLSv1.2], need-client-auth=false) **/subsystem=undertow/server=default-server/https-listener=https-listener:write-attribute(name=ssl-context, value=server-ssl-context) was: * drop two bc fips jars into java.home/jre/lib/ext ** bc-fips-1.0.1.jar ** bctls-fips-1.0.5.jar * install bc fips in java.security {code} security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider security.provider.2=org.bouncycastle.jsse.provider.BouncyCastleJsseProvider fips:BCFIPS security.provider.3=sun.security.provider.Sun {code} * remove openssl provider from standalone.xml ** /subsystem=elytron:write-attribute(name=final-providers,value=elytron) * create BCFKS keystore ** keytool, -genkeypair, -alias, appserver, -keyalg, RSA, -keysize, 2048, -keypass, password, -keystore, /home/mchoma/git-repo/tests-security/fips/target/bc-workdir/keystore.bcfks, -provider, org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider, -providerpath, /home/mchoma/.m2/repository/org/bouncycastle/fips/bc-fips/1.0.1/bc-fips-1.0.1.jar, -storetype, BCFKS, -storepass, password, -dname, CN=appserver,OU=QE,O=Redhat,L=Brno,ST=CR,C=CZ, -validity, 730, -v * create server ssl context ** /subsystem=elytron/key-store=key-store-name_server-ssl-context:add(name=key-store-name_server-ssl-context, type=BCFKS, credential-reference={clear-text => password}, path=/home/mchoma/git-repo/tests-security/fips/target/bc-workdir/keystore.bcfks ** /subsystem=elytron/key-manager=key-manager-name_server-ssl-context:add(key-store=key-store-name_server-ssl-context, credential-reference={clear-text => password}, algorithm=X509) ** /subsystem=elytron/server-ssl-context=server-ssl-context:add(key-manager=key-manager-name_server-ssl-context, cipher-suite-filter=TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,TLS_DHE_DSS_WITH_AES_128_CBC_SHA,TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,TLS_DHE_DSS_WITH_AES_256_CBC_SHA,TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA256, protocols=[TLSv1.2], need-client-auth=false) ** /subsystem=undertow/server=default-server/https-listener=https-listener:write-attribute(name=ssl-context, value=server-ssl-context) -- This message was sent by Atlassian JIRA (v7.5.0#75005)