Edit

FIPS mode

  • Article

Download JDBC driver

The Microsoft JDBC Driver for SQL Server supports running in JVMs configured to be FIPS 140 Compliant.

Prerequisites

  • FIPS configured JVM
  • Appropriate TLS/SSL Certificate
  • Appropriate policy files
  • Appropriate Configuration parameters

FIPS configured JVM

Generally, applications can configure the java.security file to use FIPS-compliant crypto providers. See the documentation specific to your JVM for how to configure FIPS 140 compliance.

To see the approved modules for FIPS Configuration, refer to Validated Modules in the Cryptographic Module Validation Program.

Vendors may have some more steps to configure a JVM with FIPS.

Appropriate TLS certificate

To connect to SQL Server in FIPS mode, a valid TLS/SSL Certificate is required. Install or import it into the Java Key Store on the client machine (JVM) where FIPS is enabled.

Importing TLS certificate in Java keyStore

For FIPS, most likely you need to import the certificate (.cert) in either PKCS or a provider-specific format. Use the following snippet to import the TLS/SSL certificate and store it in a working directory with the appropriate KeyStore format. TRUST_STORE_PASSWORD is your password for Java KeyStore.

public void saveGenericKeyStore(
        String provider,
        String trustStoreType,
        String certName,
        String certPath
        ) throws KeyStoreException, CertificateException,
            NoSuchAlgorithmException, NoSuchProviderException,
            IOException
{
    KeyStore ks = KeyStore.getInstance(trustStoreType, provider);
    FileOutputStream os = new FileOutputStream("./MyTrustStore_" + trustStoreType);
    ks.load(null, null);
    ks.setCertificateEntry(certName, getCertificate(certPath));
    ks.store(os, TRUST_STORE_PASSWORD.toCharArray());
    os.flush();
    os.close();
}

private Certificate getCertificate(String pathName)
        throws FileNotFoundException, CertificateException
{
    FileInputStream fis = new FileInputStream(pathName);
    CertificateFactory cf = CertificateFactory.getInstance("X.509");
    return cf.generateCertificate(fis);
}

The following example is importing an Azure TLS/SSL Certificate in PKCS12 format with the BouncyCastle Provider. The certificate is imported in the working directory named MyTrustStore_PKCS12 by using the following snippet:

saveGenericKeyStore(BCFIPS, PKCS12, "SQLAzure SSL Certificate Name", "SQLAzure.cer");

Appropriate policy files

For some FIPS Providers, unrestricted Policy jars are needed. In such cases, for Sun / Oracle, download the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files for JRE 8 or JRE 7.

Appropriate configuration parameters

To run the JDBC Driver in FIPS-compliant mode, configure connection properties as shown in following table.

Properties

Property Type Default Description Notes
encrypt String ["true / false / strict"] "true" For FIPS enabled JVM encrypt property should be true The default changed from false to true in version 10.2. In version 11.2.0, the type changed from boolean to String and the strict option was added to allow for TDS 8.0 support.
TrustServerCertificate boolean ["true / false"] "false" For FIPS, the user needs to validate certificate chain, so the user should use "false" value for this property.
trustStore String null Your Java Keystore file path where you imported your certificate. If you install certificate on your system, then no need to pass anything. Driver uses cacerts or jssecacerts files.
trustStorePassword String null The password used to check the integrity of the trustStore data.
fips boolean ["true / false"] "false" For FIPS enabled JVM this property should be true Added in 6.1.4 (Stable release 6.2.2)
fipsProvider String null FIPS provider configured in JVM. For example, BCFIPS or SunPKCS11-NSS Added in 6.1.2 (Stable release 6.2.2), deprecated in 6.4.0 - see the details Here.
trustStoreType String JKS For FIPS mode set trust store type either PKCS12 or type defined by FIPS provider Added in 6.1.2 (Stable release 6.2.2)