[
https://issues.apache.org/jira/browse/QPID-8777?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Partha Sarathy Maripini updated QPID-8777:
------------------------------------------
Description: Add a CertificateGeneratorFactory implementation that builds
the self-signed certificate with JDK APIs only (JCA/JCE and the JDK
CertificateFactory), for deployments that may not use any Bouncy Castle API. It
must pass AbstractCertificateGeneratorContractTest and is installed in place of
the Bouncy Castle plugin. (was: *Background:*
FIPS 140 compliance requires certificate generation to run strictly within a
validated cryptographic boundary without modifying global JVM security state
via Security.addProvider().
*Tasks:*
1. Create a separate Maven module `qpid-broker-plugins-cert-generator-bcfips`
depending on `org.bouncycastle:bc-fips`.
2. Implement `CertificateGeneratorProvider` using explicit
`BouncyCastleFipsProvider` instances passed directly to key pair generators and
signature builders.
3. Ensure no static initializers or constructors trigger thread-specific
"Approved-Only" state during QpidServiceLoader discovery scanning.
*Acceptance Criteria:*
- BC-FIPS certificate generator successfully creates self-signed certificates.
- Operations do not execute Security.addProvider() or mutate the shared JVM
provider registry.
- Plugin discovery produces no security-policy side-effects.)
> [Broker-J] Add a certificate generator that uses only JDK APIs
> --------------------------------------------------------------
>
> Key: QPID-8777
> URL: https://issues.apache.org/jira/browse/QPID-8777
> Project: Qpid
> Issue Type: Sub-task
> Components: Broker-J
> Reporter: Partha Sarathy Maripini
> Priority: Major
>
> Add a CertificateGeneratorFactory implementation that builds the self-signed
> certificate with JDK APIs only (JCA/JCE and the JDK CertificateFactory), for
> deployments that may not use any Bouncy Castle API. It must pass
> AbstractCertificateGeneratorContractTest and is installed in place of the
> Bouncy Castle plugin.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
