在OpenJDK11与Tomcat9中启用FIPS模式遇PKCS11错误求文档

已完成的配置步骤 #

• 在java.security中添加配置：security.provider.1=sun.security.pkcs11.SunPKCS11 /usr/share/tomcat/nss_pkcsll_fips.cfg
• 使用modutil安装NSS DB
• 在Tomcat的server.xml的HTTPS连接器中设置certificateKeystoreType="PKCS11"

启动时的错误信息 #

25-Nov-2022 18:09:21.046 SEVERE [main] org.apache.tomcat.util.net.SSLUtilBase.getStore Failed to load keystore type [PKCS11] with path [/home/tomcat/.keystore] due to [PKCS11 not found]
        java.security.KeyStoreException: PKCS11 not found
                at java.base/java.security.KeyStore.getInstance(KeyStore.java:878)
                at org.apache.tomcat.util.net.SSLUtilBase.getStore(SSLUtilBase.java:186)
                at org.apache.tomcat.util.net.SSLHostConfigCertificate.getCertificateKeystore(SSLHostConfigCertificate.java:207)
                at org.apache.tomcat.util.net.SSLUtilBase.getKeyManagers(SSLUtilBase.java:283)
                at org.apache.tomcat.util.net.SSLUtilBase.createSSLContext(SSLUtilBase.java:247)
                at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:105)
                at org.apache.tomcat.util.net.AbstractJsseEndpoint.initialiseSsl(AbstractJsseEndpoint.java:71)
                at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:235)
                at org.apache.tomcat.util.net.AbstractEndpoint.bindWithCleanup(AbstractEndpoint.java:1227)
                at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:1240)
                at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:606)
                at org.apache.coyote.http11.AbstractHttp11Protocol.init(AbstractHttp11Protocol.java:77)
                at org.apache.catalina.connector.Connector.initInternal(Connector.java:1048)
                at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
                at org.apache.catalina.core.StandardService.initInternal(StandardService.java:556)
                at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
                at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:1045)
                at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
                at org.apache.catalina.startup.Catalina.load(Catalina.java:724)
                at org.apache.catalina.startup.Catalina.load(Catalina.java:746)
                at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
                at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
                at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
                at java.base/java.lang.reflect.Method.invoke(Method.java:566)
                at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:305)
                at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:475)
        Caused by: java.security.NoSuchAlgorithmException: PKCS11 KeyStore not available
                at java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:159)
                at java.base/java.security.Security.getImpl(Security.java:779)
                at java.base/java.security.KeyStore.getInstance(KeyStore.java:875)

完整配置及问题修复指引 #

1. 校验NSS PKCS11配置文件 #

首先检查配置文件名拼写（当前配置中的nss_pkcsll_fips.cfg可能是笔误，正确应为nss_pkcs11_fips.cfg），确保文件内容符合规范：

name = NSSFIPS
nssLibraryDirectory = /usr/lib64
nssSecmodDirectory = /etc/pki/nssdb
nssDbMode = readOnly
nssModule = fips

• nssLibraryDirectory：指向NSS库文件所在目录，32位系统改为/usr/lib
• nssSecmodDirectory：指定用modutil创建的NSS DB目录
• 确保Tomcat运行用户对该配置文件有可读权限

2. 修正java.security配置 #

• 确认配置路径和文件名无错误，避免覆盖默认安全提供者，建议配置顺序如下：

security.provider.1=sun.security.pkcs11.SunPKCS11 /usr/share/tomcat/nss_pkcs11_fips.cfg
security.provider.2=sun.security.provider.Sun
security.provider.3=sun.security.rsa.SunRsaSign
# 保留原文件中其他安全提供者配置

• 测试配置有效性：执行java -Djava.security.debug=pkcs11 -version，无报错则说明PKCS11提供者加载成功

3. Tomcat HTTPS连接器配置调整 #

在server.xml中，PKCS11类型密钥库不需要指定文件路径，配置示例如下：

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="150" SSLEnabled="true">
    <SSLHostConfig>
        <Certificate certificateKeystoreType="PKCS11"
                     certificateKeystorePassword="你的NSS DB密码"
                     type="RSA" />
    </SSLHostConfig>
</Connector>

• 移除原配置中的keystoreFile属性
• 若NSS DB未设置密码，可省略certificateKeystorePassword

4. 启用系统FIPS模式 #

• 以RHEL/CentOS为例，检查FIPS状态：fips-mode-setup --check
• 未开启则执行fips-mode-setup --enable并重启系统
• 确保NSS DB在FIPS模式下创建，命令示例：

modutil -create -dbm /etc/pki/nssdb -fips true -force

5. 权限检查 #

• Tomcat运行用户需对NSS DB目录（如/etc/pki/nssdb）有读权限
• NSS库文件所在目录需对Tomcat用户可读

核心配置要点 #

• OpenJDK 11：确保SunPKCS11提供者正确加载，依赖FIPS合规的NSS库版本
• Tomcat 9：PKCS11密钥库无需指定文件路径，需明确certificateKeystoreType="PKCS11"
• FIPS合规：所有加密操作需通过FIPS认证模块执行，确保NSS和JDK的FIPS模式均启用

内容的提问来源于stack exchange，提问作者Suresh