BC-FIPS does not reject JKS keystores

--00000000000028c28405974d3e3c
Content-Type: text/plain; charset="UTF-8"

Hi,
After reading the docs (specifically
https://downloads.bouncycastle.org/fips-java/BC-FJA-UserGuide-1.0.2.pdf,
page 69, appendix G, point 3) I'm under the impression that BC-FIPS should
reject JKS keystores. However, I'm able to run Jetty using JKS keystores
with no issues.

I'm using AdoptOpenJDK's Java 8 with the following changes in java.security:

security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
C:HYBRID;ENABLE{ALL}
security.provider.2=org.bouncycastle.jsse.provider.BouncyCastleJsseProvider
fips:BCFIPS
security.provider.3=sun.security.provider.Sun
ssl.KeyManagerFactory.algorithm=X509


I had to change KeyManagerFactory because the default SunX509 was not
available with this provider list.

I'm starting the application with
-Dorg.bouncycastle.fips.approved_only=true, and
CryptoServicesRegistrar.isInApprovedOnlyMode() returns true as expected.

I'm using BC-FIPS 1.0.2, BCTLS-FIPS 1.0.9 and BCPKIX-FIPS 1.0.3

Am I doing something wrong, or just misreading the docs?
Thanks,
Daniel

--00000000000028c28405974d3e3c
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi,<br>After reading the docs (specifically <a href=3D"htt=
ps://downloads.bouncycastle.org/fips-java/BC-FJA-UserGuide-1.0.2.pdf">https=
://downloads.bouncycastle.org/fips-java/BC-FJA-UserGuide-1.0.2.pdf</a>, pag=
e 69, appendix G, point 3) I&#39;m under the impression that BC-FIPS should=
 reject JKS keystores. However, I&#39;m able to run Jetty using JKS keystor=
es with no issues.<br><br>I&#39;m using AdoptOpenJDK&#39;s Java 8 with the =
following changes in java.security:<br><blockquote style=3D"margin:0 0 0 40=
px;border:none;padding:0px">security.provider.1=3Dorg.bouncycastle.jcajce.p=
rovider.BouncyCastleFipsProvider C:HYBRID;ENABLE{ALL}<br>security.provider.=
2=3Dorg.bouncycastle.jsse.provider.BouncyCastleJsseProvider fips:BCFIPS<br>=
security.provider.3=3Dsun.security.provider.Sun<br>ssl.KeyManagerFactory.al=
gorithm=3DX509</blockquote><br>I had to change KeyManagerFactory because th=
e default SunX509 was not available with this provider list.<br><div><br></=
div><div>I&#39;m starting the application with -Dorg.bouncycastle.fips.appr=
oved_only=3Dtrue, and CryptoServicesRegistrar.isInApprovedOnlyMode() return=
s true as expected.<div><br></div><div>I&#39;m using BC-FIPS 1.0.2, BCTLS-F=
IPS 1.0.9 and BCPKIX-FIPS 1.0.3</div></div><div><br></div><div>Am I doing s=
omething wrong, or just misreading the docs?</div><div>Thanks,</div><div>Da=
niel</div></div>

--00000000000028c28405974d3e3c--