Re: Tomcat FIPS Configuration

2016-02-12 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Lesley and Rémy, On 2/12/16 5:50 PM, Rémy Maucherat wrote: > 2016-02-12 23:32 GMT+01:00 Lesley Kimmel > : > >> Thanks, Chris and Remy. Your comments got me thinking about >> something I hadn't considered...EPEL. tc-native is available on >> EPEL as t

Re: Tomcat FIPS Configuration

2016-02-12 Thread Rémy Maucherat
2016-02-12 23:32 GMT+01:00 Lesley Kimmel : > Thanks, Chris and Remy. Your comments got me thinking about something I > hadn't considered...EPEL. tc-native is available on EPEL as tomcat-native. > It turns out that this may not need to be compiled against a FIPS-capable > OpenSSL so long as the Ope

Re: Tomcat FIPS Configuration

2016-02-12 Thread Lesley Kimmel
Thanks, Chris and Remy. Your comments got me thinking about something I hadn't considered...EPEL. tc-native is available on EPEL as tomcat-native. It turns out that this may not need to be compiled against a FIPS-capable OpenSSL so long as the OpenSSL installation on the target system is FIPS-capab

Re: Tomcat FIPS Configuration

2016-02-12 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Rémy, On 2/12/16 2:35 PM, Rémy Maucherat wrote: > 2016-02-12 20:13 GMT+01:00 Lesley Kimmel > : > >> I am using Red Hat which provides the FIPS-enabled OpenSSL. I >> have been doing some more reading and it appears that I also now >> have to build the

Re: Tomcat FIPS Configuration

2016-02-12 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Lesley, On 2/12/16 2:13 PM, Lesley Kimmel wrote: > I am using Red Hat which provides the FIPS-enabled OpenSSL. Excellent. That's the worst part of the whole process: building a FIPS-capable library. > I have been doing some more reading and it appea

Re: Tomcat FIPS Configuration

2016-02-12 Thread Rémy Maucherat
2016-02-12 20:13 GMT+01:00 Lesley Kimmel : > I am using Red Hat which provides the FIPS-enabled OpenSSL. I have been > doing some more reading and it appears that I also now have to build the > Tomcat Native libraries against APR and OpenSSL. It does not appear that > Red Hat provides a pre-compil

Re: Tomcat FIPS Configuration

2016-02-12 Thread Lesley Kimmel
I am using Red Hat which provides the FIPS-enabled OpenSSL. I have been doing some more reading and it appears that I also now have to build the Tomcat Native libraries against APR and OpenSSL. It does not appear that Red Hat provides a pre-compiled version of these tc-native libraries. On Fri, Fe

Re: Tomcat FIPS Configuration

2016-02-12 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Lesley, On 2/12/16 1:31 PM, Lesley Kimmel wrote: > I am looking into how to enable FIPS in Tomcat. The way I interpret > is that I can either use APR connectors with a FIPS-enabled OpenSSL > or configure the java installation to utilize a 3rd party FI

Tomcat FIPS Configuration

2016-02-12 Thread Lesley Kimmel
I am looking into how to enable FIPS in Tomcat. The way I interpret is that I can either use APR connectors with a FIPS-enabled OpenSSL or configure the java installation to utilize a 3rd party FIPS library (e.g. JSafe). Is that correct?