java.security.KeyManagementException: FIPS mode: only SunJSSE TrustManagers may be used:

[longshot]

I have configured Wildfly 9.0.2 to use BCFIPS for it's security provider.  Which 'seems' to be working.  However, if I try to run jboss-cli.bat This exception gets thrown: java.securityKeyManagementException: FIPS mode: only SunJSSE TrustManagers may be used: FIPS mode: only SunJSSE TrustManagers may be used.

I don't know where this is coming from and what, if anything I can do to address this. 

[jewellgm]

The TrustManager that the Oracle JRE uses is specified in %JAVA_HOME%\lib\security\java.security.  (or %JAVA_HOME%\jre\lib\security\java.security if you are using the JDK) Look for the property "ssl.TrustManagerFactory.algorithm".  I think the default value is "PKIX".  Try setting it to "SunX509" and see if that makes a difference.  If you are running on the IBM JRE/JDK, I don't know if it is configured the same way.

[jewellgm]

I just found this, too.  The last comment, in particular, may be helpful to you.

[JBEAP-3788] Using JKS truststore leads to "FIPS mode: only SunJSSE TrustManagers may be used" - JBoss Issue Tracker

[longshot]

I tried what was listed for JBEAP-3788.  But on looking further this LOOKS like this works only with an additional code change in wildfly-core which as made in 2.1.0 Final I believe, and Wildfly 9.0.2 uses 1.0.1. 

[longshot]

No change

[mchoma]

You hit [WFCORE-644] jboss-cli needs to support using PKCS11 (including FIPS mode) keystores/truststores - JBoss Issue Tracker

Issue is raised with  PKCS11 in mind. However I believe it apply also to your case - BC FIPS.

There is workaround described - use properties -Djavax.net.ssl.* for jboss-cli. However this situation is properly resolved in WildFly 11 with Elytron. So if that is option for you, I really recommend to migrate.

Btw. property -Djboss.as.management.security.disable-dynamic-trust-manager is helpful where wildfly act as client - e.g. master-slave communicaton.

[longshot]

Thank you.  This worked! 

We will be upgrading Wildfly but not in the timeframe I need to have our application be FIPS compliant.  Thank you very much.