-
Suggestion
-
Resolution: Unresolved
-
None
-
None
-
104
-
Problem Definition
At the moment, Atlassian products do not implement any FIPS 140-2 compliant cryptographic modules on self-hosted instances, which is a requirement for multiple companies to keep using our tools.
Suggested Solution
Implement the required cryptographic modules on Atlassian products to ensure they are FIPS 140-2 compliant.
Workaround
It appears to be possible to achieve that on self-hosted products at a JVM and/or OS level.
- is related to
-
- Gathering Interest
-
ALIGNSP-13990 You do not have permission to view this issue
- was cloned as
-
- Gathering Interest
- mentioned in
-
Page Failed to load
-
Page Failed to load
-
Page Loading...
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- relates to
-
-
- resolves
-
-
- Wiki Page
-
[JRASERVER-71975] Make Jira and other Atlassian self-hosted products FIPS 140-2 compliant
Our DoD agency requires applications to be FIPS compliant. Please share the details on a workaround as this is critical to get resolved as soon as possible.
Jira Server Data Center v9.12.1
05-Jan-2024 10:13:34.530 SEVERE [main] org.apache.catalina.core.
AprLifecycleListener.lifecycleEvent Failed to initialize the SSLEngine.
java.lang.IllegalStateException: The FIPS provider must be configured as the default provider when the AprLifecycleListener is configured with FIPS mode [on] at org.apache.catalina.core.AprLifecycleListener.initializeSSL(AprLifecycleListener.java:313)
One can add a listener in the server.xml file.
<Listener
className="org.apache.catalina.core.AprLifecycleListener"
SSLEngine="on"
FIPSMode="on"/>
However, doing so does generate an error in the startup. "org.apache.catalina.core.AprLifecycleListener.lifecycleEvent Failed to initialize the SSLEngine.
java.lang.Exception: FIPS was not available to tcnative at build time. You will need to re-build tcnative against an OpenSSL with FIPS." So, it would appear that this is available, but the Tomcat needs to be recompiled before it can be used.
Any updates on this? This would be a requirement if we need to run Jira on-prem to achieve FedRAMP.
How is this not even being worked yet? I work in a DoD environment, and this is a major issue!
@Atlassian, Same as previous commenters, we have multiple instances that need to be compliant. Especially the higher level ATOs.
Our agency is requires applications to be FIPS compliant. As previously stated, lack of compliance can negative impact our Authority To Operate (ATO).
I represent a firm that has worked with over 100 customers for FedRAMP compliant environments, all of whom would benefit greatly from Atlassian products ensuring they are FIPS 140-2 compliant. There is a massive gap of good ticketing and DevOps tooling with FIPS mode available.
We were able to workaround this issue by following this guide:
https://access.redhat.com/documentation/en-us/red_hat_build_of_openjdk/11/html/configuring_red_hat_build_of_openjdk_11_on_rhel_with_fips/config-fips-in-openjdk
YMMV
Obviously still not entirely FIPS compliant, but the application runs with FIPS enabled so that's good.