Enabling FIPS Mode

Subscription

Liferay DXP 2026.Q3+

Enable FIPS mode when your Liferay DXP installation must use cryptographic modules validated under FIPS 140-3. At every startup in FIPS mode, DXP checks the security provider and the properties below, and it doesn’t start until every check passes. Prepare them first. On Tomcat, also configure the session ID generator, which DXP doesn’t check.

Once FIPS mode is on, features such as LDAP, SAML, and OAuth2 accept only approved algorithms. For the algorithms and key sizes each feature accepts, see FIPS Mode Reference.

Registering a FIPS Security Provider

The first security provider registered in the JVM must be one of these:

Provider	Required State
Bouncy Castle FIPS (`BCFIPS`)	Running in approved-only mode, with its FIPS self-test status ready
Amazon Corretto Crypto Provider (`AmazonCorrettoCryptoProvider`)	A FIPS build that isn’t experimental and reports itself healthy

Every provider registered after the first one must come from the list allowed for that first provider:

First Provider	Providers Allowed After It
`AmazonCorrettoCryptoProvider`	`JdkLDAP`, `JdkSASL`, `SUN`, `SunEC`, `SunJCE`, `SunJGSS`, `SunJSSE`, `SunRsaSign`, `SunSASL`, and `XMLDSig`
`BCFIPS`	`BCJSSE`, `JdkLDAP`, `JdkSASL`, `SUN`, `SunJCE`, `SunJGSS`, `SunSASL`, and `XMLDSig`

Install and configure your provider by following its vendor’s documentation: Bouncy Castle Java FIPS documentation or Amazon Corretto Crypto Provider FIPS.
In the java.security file the JVM starts with, or in a file you pass with -Djava.security.properties, register your provider first, followed only by providers from its allowed list. Register it there because the application server creates its session ID generator at startup. A provider registered after that doesn’t apply to session IDs.
Remove every registered provider that isn’t on the first provider’s allowed list. On Linux, a default JDK 21 registers SunPCSC and SunPKCS11, which aren’t on either list, so remove them whichever provider is first. With BCFIPS first, also remove SunEC, SunJSSE, and SunRsaSign.

Important

On WebLogic, Oracle’s FIPS instructions register the Jipher JCE provider first and SunJSSE second. Register BCFIPS or AmazonCorrettoCryptoProvider first instead, because FIPS mode doesn’t accept Jipher.

Setting the JVM Properties

Liferay DXP 2026.Q4+

DXP checks these JVM security properties and system properties at startup. A property that isn’t set fails its check.

Set the security properties in the file where you registered the provider:

Security Property	Requirement
`jdk.tls.disabledAlgorithms`	Lists `SSLv3`, `TLS_RSA_*`, `TLSv1`, and `TLSv1.1`
`ocsp.enable`	`true`
`ssl.TrustManagerFactory.algorithm`	`PKIX`

Each required value must be its own entry in the property’s comma-separated list. Write TLS_RSA_* as one entry, as shown, instead of listing individual cipher suites.

A file passed with -Djava.security.properties replaces the JVM’s value for each property it sets. To add entries to jdk.tls.disabledAlgorithms in that file, copy the JVM’s list and add the missing entries.

Pass the system properties as JVM options:

System Property	Requirement
`com.sun.net.ssl.checkRevocation`	`true`
`com.sun.security.enableCRLDP`	`true`
`jdk.tls.client.protocols`	`TLSv1.2`, `TLSv1.3`, or both, separated by a comma

On Tomcat, this line in setenv.sh sets all three:

CATALINA_OPTS="$CATALINA_OPTS -Dcom.sun.net.ssl.checkRevocation=true -Dcom.sun.security.enableCRLDP=true -Djdk.tls.client.protocols=TLSv1.2,TLSv1.3"

In a Docker container, pass them in the LIFERAY_JVM_OPTS variable instead.

DXP also checks that the JVM’s default SecureRandom comes from BCFIPS or AmazonCorrettoCryptoProvider. The JVM takes it from the first registered provider that supplies SecureRandom, so the check passes when your FIPS provider is first and supplies one. AmazonCorrettoCryptoProvider supplies one only when the com.amazon.corretto.crypto.provider.registerSecureRandom system property is true, its default from version 2.4.0.

Preparing the Portal Properties

DXP checks these portal properties. Set them in portal-ext.properties or with Liferay Env variables.

Algorithm Properties

With their default values, only passwords.encryption.algorithm must change, plus auth.mac.algorithm when you set auth.mac.allow=true.

Property	Default	Requirement
`passwords.encryption.algorithm`	`PBKDF2WithHmacSHA1/160/1300000`	PBKDF2 with HMAC-SHA256, an output length of at least 112 bits, and at least 1,300,000 rounds
`company.encryption.algorithm`	`AES`	A value that starts with an allowed algorithm name
`tunneling.servlet.encryption.algorithm`	`AES`	A value that starts with an allowed algorithm name
`auth.mac.algorithm`	`MD5`	Checked only when `auth.mac.allow=true`. One of the allowed SHA names: `SHA-256`, `SHA-384`, or `SHA-512`. DXP uses this value as a message digest.

The allowed algorithm names are AES, HmacSHA256, HmacSHA384, HmacSHA512, PBKDF2WithHmacSHA256, PBKDF2WithHmacSHA384, PBKDF2WithHmacSHA512, SHA-256, SHA-384, and SHA-512.

PBKDF2WithHmacSHA384 and PBKDF2WithHmacSHA512 are allowed names, but they fail the passwords.encryption.algorithm check. This value passes:

passwords.encryption.algorithm=PBKDF2WithHmacSHA256/256/1300000

If DXP has already started with another algorithm, see Migrating from an Existing Algorithm. For passwords already stored with an algorithm FIPS mode doesn’t verify, see FIPS Mode Reference.

Sensitive Values

A sensitive property fails its check when a properties file other than portal.properties holds a plain text value for it. The admin.obfuscated.properties property lists the sensitive keys. By default, it lists

auth.mac.shared.key
auth.token.shared.secret
default.admin.password
dl.file.entry.preview.generation.decrypt.passwords.pdfbox
dl.repository.guest.password
jdbc.default.password
tunneling.servlet.shared.secret

For example, a database password set in portal-ext.properties fails with A plaintext value for property "jdbc.default.password" in "portal-ext.properties" is not allowed in FIPS mode. Supply the database password in one of these ways instead:

Set it in the LIFERAY_JDBC_PERIOD_DEFAULT_PERIOD_PASSWORD Liferay Env variable, and remove jdbc.default.password from every properties file. A plain text value left in a file fails the check even when the variable is set.
Use a JNDI data source by setting jdbc.default.jndi.name. The password then stays in the application server’s data source configuration, and you don’t set jdbc.default.password. To configure one on Tomcat, see Setting Up JNDI on Tomcat.

Session and Tunneling Properties

Liferay DXP 2026.Q4+

Both properties pass the check with their default values:

Property	Default	Requirement
`session.timeout`	`15`	720 minutes (12 hours) or less
`com.liferay.portal.kernel.service.http.TunnelUtil.verify.ssl.hostname`	`true`	`true`

Configuring Tomcat’s Session ID Generator

On Tomcat, set the session ID generator to use the FIPS provider. DXP doesn’t check this setting at startup. Without it, Tomcat generates session IDs with its default algorithm, SHA1PRNG, from the non-FIPS SUN provider when SUN is registered.

In Tomcat’s conf/context.xml, replace the Liferay Tomcat bundle’s <Manager> element with one that keeps its pathname attribute and sets secureRandomProvider to your first provider and secureRandomAlgorithm to DEFAULT. For BCFIPS, use this element:
```
<Manager pathname="SESSIONS.ser" secureRandomAlgorithm="DEFAULT" secureRandomProvider="BCFIPS" />
```
For AmazonCorrettoCryptoProvider, use this element:
```
<Manager pathname="SESSIONS.ser" secureRandomAlgorithm="DEFAULT" secureRandomProvider="AmazonCorrettoCryptoProvider" />
```
With an Amazon Corretto Crypto Provider FIPS build earlier than version 2.4.0, set the com.amazon.corretto.crypto.provider.registerSecureRandom system property to true so the provider registers DEFAULT.
If you’ve set up session replication, set the same two attributes on the LiferayDeltaManager <Manager> element in conf/server.xml.
After you start DXP, check the Tomcat log for a SEVERE error that begins with Exception initializing random number generator. Tomcat logs it when a provider or algorithm name is wrong, then falls back to SHA1PRNG and keeps starting.

WildFly and JBoss EAP need no extra setting, because they generate session IDs with the JVM’s default SecureRandom, which comes from the first registered provider that supplies SecureRandom.

Starting DXP in FIPS Mode

Set fips.enabled=true in portal-ext.properties:
```
fips.enabled=true
```
Alternatively, set the environment variable:
```
LIFERAY_FIPS_PERIOD_ENABLED=true
```
Restart DXP.
Check the log. If a check fails, DXP doesn’t start, and the log shows the check’s message (see Troubleshooting a Failed Startup).

Troubleshooting a Failed Startup

Correct the setting that the failed check’s message names, and restart DXP.

Security Provider Messages

To correct these, see Registering a FIPS Security Provider.

Message	Cause
`The first security provider must be an allowed FIPS provider`	The first registered provider isn’t `BCFIPS` or `AmazonCorrettoCryptoProvider`.
`BCFIPS is not in approved only mode`	`BCFIPS` isn’t running in approved-only mode.
`BCFIPS integrity self test failed: [status]`	The `BCFIPS` self-test status isn’t ready.
`AmazonCorrettoCryptoProvider must be a nonexperimental FIPS build`	The build isn’t a FIPS build, or it’s experimental.
`FIPS provider integrity failed: [reason]`	The first provider’s health check or self-test status check failed with an error.
`The security providers [providers] are not allowed in FIPS mode for [provider]`	A registered provider isn’t on the first provider’s allowed list.
Liferay DXP 2026.Q4+The secure random provider “[provider]” is not allowed in FIPS mode`\| The JVM's default`SecureRandom`comes from a provider other than`BCFIPS`or`AmazonCorrettoCryptoProvider.
Liferay DXP 2026.Q4+Unable to determine the default SecureRandom provider`\| DXP couldn't read which provider supplies the JVM's default`SecureRandom.

JVM Property Messages

Liferay DXP 2026.Q4+

To correct these, see Setting the JVM Properties.

Message	Cause
`FIPS mode requires the property "[key]" to include "[value]"`	A security or system property isn’t set or lacks the required value.
`FIPS mode requires the property "jdk.tls.client.protocols" to be set to only [TLSv1.2, TLSv1.3]`	`jdk.tls.client.protocols` isn’t set, or lists another protocol.

Portal Property Messages

To correct these, see Preparing the Portal Properties.

Message	Cause
`Algorithm "[value]" is not allowed in FIPS mode`	An algorithm property holds a value the check rejects.
`PBKDF2 output length [bits] bits is below the minimum allowed value of 112 bits`	The `passwords.encryption.algorithm` output length is under 112 bits.
`PBKDF2 iteration count [rounds] is below the minimum allowed value of 1300000`	The `passwords.encryption.algorithm` round count is under 1,300,000.
`A plaintext value for property "[key]" in "[file]" is not allowed in FIPS mode`	A key that `admin.obfuscated.properties` lists holds a plain text value.
Liferay DXP 2026.Q4+Session timeout must not be greater than 12 hours in FIPS mode`\|`session.timeout is over 720.
Liferay DXP 2026.Q4+FIPS mode requires the property “com.liferay.portal.kernel.service.http.TunnelUtil.verify.ssl.hostname” to be enabled`\| The property isn't`true.