[
https://issues.apache.org/jira/browse/KAFKA-20997?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18109255#comment-18109255
]
Gergely Harmadás commented on KAFKA-20997:
------------------------------------------
[~mimaison] I know it is not exactly the same but I have faced a similar
TLS-related issue with FIPS. Usually those environments operate with a
restricted set of ciphers which can cause issues if an unsupported cipher ends
up in the broker config. My proposed solution in KAFKA-20676 also follows the
same pattern, instead of a hard crash at startup the broker would continue as
long as there is at least one supported cipher in {*}ssl.cipher.suites{*}.
Might be worth linking the two JIRAs together.
> Support running in FIPS environments
> ------------------------------------
>
> Key: KAFKA-20997
> URL: https://issues.apache.org/jira/browse/KAFKA-20997
> Project: Kafka
> Issue Type: Improvement
> Reporter: Mickael Maison
> Assignee: Mickael Maison
> Priority: Major
>
> The default SSL engine factory implementation statically loads a KeyFactory
> for the DSA algorithm at startup. This prevents brokers from stating in FIPS
> environments where DSA is not available.
> Instead of failing at the key factory creation, broekrs should ignore key
> factories that can't be loaded (just log a message) and only fail if a key
> requires a factory that wasn't loaded.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
