Hi Qpid Experts, I am working on deploying Apache Qpid Broker-J in regulated environments that mandate strict FIPS 140 compliance. Currently, Broker-J relies on standard Bouncy Castle libraries (bc-prov / bcprov-jdk18on), which are not FIPS 140 certified.
I have created a JIRA ticket to track this improvement: *QPID-8773:* https://issues.apache.org/jira/browse/QPID-8773 I am preparing a Pull Request for this feature and wanted to gather feedback from the maintainers on the proposed implementation details: 1. *Dynamic Provider Registration:* Introduce a configuration property (e.g., qpid.security.tls.enableFIPSMode=true) to conditionally register org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider inside SSLUtil.java <https://github.com/apache/qpid-broker-j/blob/49098be941a6e6c5c5fc17759c30e0e1e0331c80/broker-core/src/main/java/org/apache/qpid/server/transport/network/security/ssl/SSLUtil.java#L117> and related security modules(if any). 2. *Classpath & Dependency Swap:* Provide a mechanism (e.g., via Maven profiles or provided dependency substitution instructions) to allow deployers to swap bc-prov for bc-fips without classpath conflicts. 3. *Zero Overhead for Standard Users:* Non-FIPS deployments will retain their existing legacy behavior by default. Before finalizing the PR, I would welcome your thoughts on: - Are there any preferred architectural patterns or existing efforts around FIPS compliance in Broker-J? - Is dynamic reflection preferred for registering BouncyCastleFipsProvider to avoid hard compile-time requirements on bc-fips in default builds? Could a committer please assign *QPID-8773* to my JIRA account (*Partha Sarathy Maripini*)? Looking forward to your guidance and contributing this improvement to the project. Best regards, Partha Sarathy Maripini
