Chapter 3. Default FIPS configurations in OpenJDK 17

Red Hat build of OpenJDK 21 includes Introduction to Federal Information Processing Standards (FIPS) configurations that default to FIPS-complaint settings.

Review the following Red Hat build of OpenJDK 21 default FIPS configurations before you consider making any changes to these default configurations:

3.1. Security providers

The global java security policy file controls the Red Hat build of OpenJDK security policy. You can locate the java security policy file at $JRE_HOME/lib/security/

With FIPS mode enabled, Red Hat build of OpenJDK replaces the installed security providers with the following ones, which are listed in descending priority order:


  • Initialized with a Network Security Services (NSS) Software Token (PKCS#11 backend). The NSS Software Token contains the following configuration:

    • name = NSS-FIPS
    • nssLibraryDirectory = /usr/lib64
    • nssSecmodDirectory = /etc/pki/nssdb
    • nssDbMode = readOnly
    • nssModule = fips
  • The NSS library implements a FIPS-compliant Software Token. Also, FIPS policy-aware in RHEL.


  • For X.509 certificates support only. Check that your application is not using other cryptographic algorithms from this provider. Otherwise, the security provider throws a message.


  • For SunPKCS11 auxiliary helpers only. Check that your application is not explicitly using this provider.


  • For TLS support, SunJSSE uses the SUN provider for X.509 certificates and the SunPKCS11-NSS-FIPS provider for all cryptographic primitives.

3.2. Crypto-policies

With FIPS mode enabled, Red Hat build of OpenJDK takes configuration values of cryptographic algorithms from global crypto-policies. You can find these values at /etc/crypto-policies/back-ends/java.config. You can use the update-crypto-policies tooling from RHEL to manage crypto-policies in a consistent way.


A crypto-policies approved algorithm might not be usable in Red Hat build of OpenJDK’s FIPS mode. This occurs when a FIPS-compliant implementation is not available in the NSS library or when it is not supported in Red Hat build of OpenJDK’s SunPKCS11 security provider.

3.3. Trust Anchor certificates

Red Hat build of OpenJDK uses the global Trust Anchor certificates repository when in FIPS mode. You can locate this repository at /etc/pki/java/cacerts. Use the update-ca-trust tooling from RHEL to manage certificates in a consistent way.

3.4. Key store

With FIPS mode, Red Hat build of OpenJDK uses the NSS DB as a read-only PKCS#11 store for keys. As a result, the keystore.type security property is set to PKCS11. You can locate the NSS DB repository at /etc/pki/nssdb. Use the modutil tooling in RHEL to manage NSS DB keys.

Revised on 2023-11-14 21:10:56 UTC