CA Layer7 API Gateway 11 wont start after enabling FIPS software form factor
Article ID: 370280
Updated On:
Products
Issue/Introduction
RHEL 8.3 software install api gateway service was running fine. After enabling either
security.fips.enabled cluster property to "true"
OR
"com.l7tech.security.fips.enabled=true" in the system.properties
The observed behavior is the same. The process controller hangs with the message "Getting API port from /opt/SecureSpan/Gateway/node/default/var/processControllerPort" message.
Environment
Form Factor: Software
Version: Api Gateway 11.x
Cause
The key difference between CryptoComply for Java versions 3.0.1 and 3.0.2.1 is that CCJ now obtains entropy from "Strong" instance of SecureRandom.
Resolution
The rngd service (Hardware RNG Entropy Gatherer Daemon) is required by the api gateway to start in FIPS mode.
Starting with RHEL 8.3 the rngd service is not installed by default.
You must install / enable o/s rngd service
OR
Alternately you can configure a different secure random,
Configure the java.security OR ssg.security
the securerandom.strongAlgorithm as below;
=======
#
# A list of known strong SecureRandom implementations.
#
# To help guide applications in selecting a suitable strong
# java.security.SecureRandom implementation, Java distributions should
# indicate a list of known strong implementations using the property.
#
# This is a comma-separated list of algorithm and/or algorithm:provider
# entries.
#
securerandom.strongAlgorithms=DRBG:SUN
Ref:
Feedback
