Skip to content

Conversation

@yurem
Copy link
Contributor

@yurem yurem commented Jul 30, 2021

This update add support for RHEL 8.4 with DISA STIG Security Profile.
The code inside this PR updates SSL related parts to conform FIPS 140-2 Cryptography for SSL/TLS.

Before running setup we need to generate key in PKCS11 keystore.

keytool -genkey -alias server-cert -keyalg rsa -dname "CN=FQDN,O=OpenDJ RSA Self-Signed Certificate" -keystore NONE -storetype PKCS11 -storepass changeit
keytool -selfcert -alias server-cert -validity 3650 -keystore NONE -storetype PKCS11 -storepass changeit

After that we can run setup and specify usePkcs11Keystore=true

In order to run opendj commands we can specify additional parameters:

--trustStorePath /opt/opendj/config/admin-truststore --trustStorePasswordFile /opt/opendj/config/keystore.pin

@yurem
Copy link
Contributor Author

yurem commented Jul 30, 2021

This PR also contains fix for remove attribute method in ConfigureDS.java.

@vharseko vharseko merged commit 2cf4608 into OpenIdentityPlatform:master Jul 30, 2021
@halper
Copy link

halper commented Oct 1, 2021

Hey @yurem,

Thanks for doing a great job. I was wondering if you are planning to publish a document for configuring OpenDJ with FIPS support? And I assume the end user will be able to use FIPS support with the next version.

Cheers,
Alper

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants