Cloudera Docs

Upgrading from JDK 8 to JDK 17 on FIPS

Upgrade from JDK 8 to JDK 17 on FIPS-compliant hosts by modifying system Java environment variables, provider policies, and Cloudera Manager configuration settings.

You must change the Java configurations on all hosts and in Cloudera Manager to upgrade from JDK 8 to JDK 17.

  1. Create the ccj.sh file in the /etc/profile.d/ directory to configure the Java environment variable. 
    echo "export JDK_JAVA_OPTIONS='--module-path=/opt/cloudera/fips/ccj-4.0.0.jar:/opt/cloudera/fips/bctls-safelogic.jar --add-exports java.base/sun.security.provider=com.safelogic.cryptocomply.fips.core --add-modules com.safelogic.cryptocomply.fips.core,bctls.safelogic'" >/etc/profile.d/ccj.sh
sudo chmod +x /etc/profile.d/ccj.sh
  2. Edit the $JAVA_HOME/conf/security/java.security file to configure the java.security policy.
  3. Set the security.useSystemPropertiesFile property value to false.
  4. Comment out the default security.provider line and insert the following prioritized cryptographic providers: 
    #
# List of providers and their preference orders (see above):
#
security.provider.1=com.safelogic.cryptocomply.jcajce.provider.CryptoComplyFipsProvider
security.provider.2=org.bouncycastle.jsse.provider.BouncyCastleJsseProvider fips:CCJ
security.provider.3=SUN
security.provider.4=SunRsaSign
security.provider.5=SunEC
security.provider.6=SunJSSE
security.provider.7=SunJCE
security.provider.8=SunJGSS
security.provider.9=SunSASL
security.provider.10=XMLDSig
security.provider.11=SunPCSC
security.provider.12=JdkLDAP
security.provider.13=JdkSASL
  5. Comment out the default fips.providers line and register the SafeLogic and BouncyCastle compliance modules: 
    #
# Security providers used when FIPS mode support is active
#
fips.provider.1=com.safelogic.cryptocomply.jcajce.provider.CryptoComplyFipsProvider
fips.provider.2=org.bouncycastle.jsse.provider.BouncyCastleJsseProvider fips:CCJ
fips.provider.3=SUN
fips.provider.4=SunRsaSign
fips.provider.5=SunEC
fips.provider.6=SunJSSE
fips.provider.7=SunJCE
fips.provider.8=SunJGSS
fips.provider.9=SunSASL
fips.provider.10=XMLDSig
fips.provider.11=SunPCSC
fips.provider.12=JdkLDAP
fips.provider.13=JdkSASL
  6. Update the system parameters within your Cloudera Manager configuration file:
    1. Open the /etc/default/cloudera-scm-server file.
    2. In the sections designated for JDK17 or higher, and uncomment the following FIPS configurations, ensuring that they point to the correct JAR files and modules: 
      # Enable FIPS mode
#
# To enable FIPS mode set the -Dcom.cloudera.cmf.fipsMode to true
#
export CMF_JAVA_OPTS="${CMF_JAVA_OPTS} -Dcom.cloudera.cmf.fipsMode=true"
#
# If JDK version is 11 or higher:
# Uncomment and provide values below to include CCJ with FIPS mode
export CMF_JAVA_OPTS="${CMF_JAVA_OPTS} 
-Dcom.cloudera.cloudera.cmf.fipsMode.jdk11plus.ccj.jar.path=/opt/cloudera/fips/ccj-4.0.0.jar 
-Dcom.cloudera.cloudera.cmf.fipsMode.jdk11plus.ccj.moduleName=ccj_module_name"
#
# If JDK version is 11 or higher:
# Uncomment and provide values below to include BCTLS with FIPS mode
export CMF_JAVA_OPTS="${CMF_JAVA_OPTS} 
-Dcom.cloudera.cloudera.cmf.fipsMode.jdk11plus.bctls.jar.path=/opt/cloudera/fips/bctls-safelogic.jar 
-Dcom.cloudera.cloudera.cmf.fipsMode.jdk11plus.bctls.moduleName=bctls_module_name"

      Example

      If the .ccj jar file name is ccj-test-4.0.0.jar, then the module name becomes cj.test. The version numbers are ignored.

      You can extract and confirm the precise runtime module descriptor name by using the following command: 
      $ sudo ${JAVA_HOME}/bin/jar --file=/opt/cloudera/fips/ccj-test-4.0.0.jar --describe-module
No module descriptor found. Derived automatic module.
ccj.test@4.0.0 automatic <---- module Name is ccj.test
requires java.base mandated contains com.safelogic.cryptocomply
Validate that the Java installation is correct. For instructions, see Validate the CCJ and CCS installations for JDK 17.