ActiveMQ run in FIPS mode

Question

I am workinf with ActiveMQ 5.14 my ssl configuration is:

<sslContext>
        <sslContext keyStore="file:${activemq.base}/conf/keystore/activemq/activemq.bcfks" keyStorePassword="password" keyStoreType="BCFKS" 
              trustStore="file:${activemq.base}/conf/keystore/activemq/cacerts.bcfks" trustStorePassword="password" trustStoreType="BCFKS" />
    </sslContext>

our JVM is configured to be in FIPS mode:

security.provider.4=com.safelogic.cryptocomply.jcajce.provider.CryptoComplyFipsProvider
security.provider.5=com.sun.net.ssl.internal.ssl.Provider CCJ

if FIPS mode is on ActiveMQ failed to start with ERROR:

Error creating bean with name 'org.apache.activemq.xbean.XBeanBrokerService#0' defined in class path resource [activemq.xml]: Invocation of init method failed; nested exception is java.io.IOException: Transport Connector could not be registered in JMX: java.io.IOException: FIPS mode: SecureRandom must be from provider CCJ | org.apache.activemq.xbean.XBeanBrokerFactory$1 | main

I try to inti the secureRandom using Spring spel : secureRandom="#{T(java.security.SecureRandom).getInstance('DEFAULT','CCJ')}" -

or

secureRandom="CCJ"

it didn't work!!! How can I force the secureRandom provider to be from type 'CCJ'

Thanks,

Answer 1

The following configuration in activemq.xml worked for me while working with AMQ 5.15.0 together with CCJ:

<sslContext>
   <sslContext 
        keyStore="file:${activemq.conf}/broker.ks" 
        keyStorePassword="123456" 
        keyStoreType="BCFKS" 
        trustStore="file:${activemq.conf}/broker.ts" 
        trustStorePassword="123456" 
        trustStoreType="BCFKS" 
        secureRandomAlgorithm="DEFAULT" />
</sslContext>

It also worked for me when I additionally added the XML attribute "provider" with the value of CCJ to the sslContext:

<sslContext>
   <sslContext 
        keyStore="file:${activemq.conf}/broker.ks" 
        keyStorePassword="123456" 
        keyStoreType="BCFKS" 
        trustStore="file:${activemq.conf}/broker.ts" 
        trustStorePassword="123456" 
        trustStoreType="BCFKS" 
        secureRandomAlgorithm="DEFAULT" 
        **provider="CCJ"**/>
</sslContext>