Importing FIPS-Compliant Keystores#

When the Curity Identity Server runs in FIPS mode, private keys must be supplied in a format that the FIPS-validated cryptographic module can use. This page describes which keystore formats are accepted, how to convert an existing keystore, and how to import it. For an overview of FIPS mode, see FIPS Compliance .

The PKCS#12, JKS, and JCEKS keystore formats are not supported in FIPS mode. A keystore in one of those formats must be converted to a supported format before it can be imported.

Supported formats#

The Curity Identity Server parses uploaded key material by its content, not by the file extension. The following formats are accepted in FIPS mode:

  • PEM or DER — a certificate, a private key, or both.
  • JWK — a single public or private key.
  • A BCFKS keystore — the FIPS keystore format.

PEM, DER, and JWK are accepted in both FIPS and non-FIPS deployments. The keystore formats used outside FIPS — PKCS#12, JKS, and JCEKS — are not accepted in FIPS mode; BCFKS takes their place.

Converting an existing PKCS#12 keystore#

Convert the key material outside the server, then import the result. Export the private key and certificate from the PKCS#12 keystore as PEM:

openssl pkcs12 -in keystore.p12 -out key-and-certificate.pem -nodes

Generating a new keystore#

To create a fresh FIPS-compliant key, use the Admin UI Generate Keystore action or the genkeyconf command-line tool. Both produce a BCFKS keystore, so no conversion is required.

Importing the keystore#

Once you have a keystore in a supported format, import it the same way as any other private key — through the Admin UI, a crypto action in the CLI, or a <keystore> value in an XML configuration document. See Configuring private keystores for the mechanics, supplying the BCFKS or PEM data in place of a PKCS#12 keystore.

Was this helpful?