FIPS Mode

Subscription

Liferay DXP 2026.Q3+

Use FIPS mode when your Liferay DXP installation must use cryptographic modules validated under Federal Information Processing Standards (FIPS) 140-3, the U.S. government’s security standard for cryptographic modules. DXP relies on a validated security provider that you install in the JVM, and it checks at startup that the provider and its settings meet FIPS requirements.

FIPS mode is off by default. To turn it on, see Enabling FIPS Mode.

Startup Checks

With FIPS mode on, DXP starts only when all of these checks pass:

• Security provider: The first registered Java Cryptography Architecture (JCA) provider is Bouncy Castle FIPS (BCFIPS) or Amazon Corretto Crypto Provider (AmazonCorrettoCryptoProvider), in the required state.
• Other providers: Every other registered provider is on the allowed list for the first provider.
• Portal properties: The portal properties that FIPS mode checks have allowed values.
• JVM properties (Liferay DXP 2026.Q4+): The JVM security and system properties have the required values, and the JVM’s default SecureRandom comes from the FIPS provider.

What You Set Up Outside DXP

These parts of the environment are yours to set up:

• The FIPS provider, installed in the JVM and registered in the required order
• On Tomcat, a session ID generator that uses the FIPS provider
• The operating system’s entropy source
• The time source
• TLS cipher enforcement for inbound connections, at the load balancer or proxy

Next Steps

• Enabling FIPS Mode: Prepare the JVM and portal properties, and turn on FIPS mode.
• FIPS Mode Reference: How passwords, LDAP, SAML, OAuth 2, and other features behave in FIPS mode.
• Key Manager: Set up the AWS profile FIPS mode needs before DXP can save secrets, and wrap company keys with an AWS KMS key.
• Key Manager Reference: Every Key Manager setting, the secret reference format, and the messages DXP shows or logs.