[
https://issues.apache.org/jira/browse/QPID-8777?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Partha Sarathy Maripini updated QPID-8777:
------------------------------------------
Summary: [Broker-J] Add a certificate generator that uses only JDK APIs
(was: [Broker-J] Implement BC-FIPS certificate generator plugin using explicit
provider instances)
> [Broker-J] Add a certificate generator that uses only JDK APIs
> --------------------------------------------------------------
>
> Key: QPID-8777
> URL: https://issues.apache.org/jira/browse/QPID-8777
> Project: Qpid
> Issue Type: Sub-task
> Components: Broker-J
> Reporter: Partha Sarathy Maripini
> Priority: Major
>
> *Background:*
> FIPS 140 compliance requires certificate generation to run strictly within a
> validated cryptographic boundary without modifying global JVM security state
> via Security.addProvider().
> *Tasks:*
> 1. Create a separate Maven module `qpid-broker-plugins-cert-generator-bcfips`
> depending on `org.bouncycastle:bc-fips`.
> 2. Implement `CertificateGeneratorProvider` using explicit
> `BouncyCastleFipsProvider` instances passed directly to key pair generators
> and signature builders.
> 3. Ensure no static initializers or constructors trigger thread-specific
> "Approved-Only" state during QpidServiceLoader discovery scanning.
> *Acceptance Criteria:*
> - BC-FIPS certificate generator successfully creates self-signed certificates.
> - Operations do not execute Security.addProvider() or mutate the shared JVM
> provider registry.
> - Plugin discovery produces no security-policy side-effects.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
