You can enable FIPS 140-2 mode with the Jipher JCE and SunJSSE providers using Java security files and specifying Java options on the command line.

1. Create your own java.security file. You can use the one that comes with the installed JDK as a guide.
2. Add the Jipher JCE provider as the first Java security provider listed in your java.security properties file. Move the rest of the providers down one position:

   security.provider.1=com.oracle.jipher.provider.JipherJCE
   security.provider.2=SunJSSE
   security.provider.3=SUN

3. Add keystore.type=pkcs12 in your java.security properties file to block non-PKCS12 type keystores. If the keystore.type=jks system property already exists in the file, delete it.
4. Set -Djava.security.properties and -Dweblogic.security.fips140strictkeystores=true on the WebLogic Server start command line to override the default configuration in the java.security file and prevent WebLogic Server from using any non-PKCS12 type keystores, respectively. For -Djava.security.properties, specify a full file path to your custom java.security file.

   set JAVA_OPTIONS="-Djava.security.properties=C:\Users\user\java.security -Dweblogic.security.fips140strictkeystores=true"
   

   Note:

   Use a single equal sign (=) to specify a filename if you want the java.security properties to be appended to the installed JRE security properties. Use two equal signs (==) if you want to override all the Java security properties, for instance, -Djava.security.properties==C:\Users\user\java.security.
5. Start WebLogic Server.
   If you are upgrading from a WebLogic Server environment that uses JKS keystores and blocking JKS keystores will cause issues, you can set weblogic.security.fips140strictkeystores=false and keystore.type=jks. However, for strict FIPS compliance, you should convert any JKS keystores instead. See Converting a Non-FIPS Compliant Keystore Using the Jipher JCE Provider for more information and conversion instructions.

You can enable FIPS 140-2 mode from the installed JDK java.security file.

1. Edit the java.security file to add the Jipher JCE provider as the first Java security provider listed in the java.security properties file. Move the rest of the providers down a position:

   security.provider.1=com.oracle.jipher.provider.JipherJCE
   security.provider.2=SunJSSE
   security.provider.3=SUN

2. Add keystore.type=pkcs12 to block non-PKCS12 type keystores. If the keystore.type=jks property already exists in the file, delete it.
3. Set weblogic.security.fips140strictkeystores=true on the WebLogic Server start command line to prevent WebLogic Server from using any non-PKCS12 type keystores.

   set JAVA_OPTIONS=-Dweblogic.security.fips140strictkeystores=true
   

4. Start WebLogic Server.
   If you are upgrading from a WebLogic Server environment that uses JKS keystores and blocking JKS keystores will cause issues, you can set keystore.type=jks in the java.security file and weblogic.security.fips140strictkeystores=false as a system property. However, for strict FIPS compliance, you should convert any JKS keystores instead. See Converting a Non-FIPS Compliant Keystore Using the Jipher JCE Provider for more information and conversion instructions.

Using the WebLogic Server distribution classpath, you can convert a non-compliant keystore using the keytool –importkeystore command with the Jipher JCE provider.

To convert a non-compliant keystore using the Jipher JCE provider:

keytool -importkeystore -srckeystore srckeystore          
–srcstoretype srcstoretype         
-srcprovidername providername –destkeystore destkeystore
-deststoretype PKCS12 -destprovidername JipherJCE
-providerclass com.oracle.jipher.provider.JipherJCE
-providerpath $CLASSPATH 

In this command, provide values for the following parameters:

• -srckeystore – Name of the source keystore
• -srcstoretype – Type of source keystore, for example PKCS12
• -srcprovidername – Name of the source keystore provider. Set to JipherJCE if srcstoretype is PKCS12
• -destkeystore - Name of the destination keystore
• -deststoretype – Type of destination keystore. Set to PKCS12 for the Jipher JCE provider
• -destprovidername – Name of the destination keystore provider. Set to JipherJCE for the Jipher JCE provider
• -providerclass – Name of the provider class. Set to com.oracle.jipher.provider.JipherJCE
• -providerpath - Classpath for the provider

1. Load the JKS keystore with the default provider and save it as a PKCS12 keystore with the Jipher JCE provider.

   keytool -importkeystore -v
         -srckeystore $JAVA_HOME/jre/lib/security/cacerts  
         -srcstoretype JKS
         -destkeystore cacerts.p12 
         -deststoretype PKCS12
         -destprovidername JipherJCE 
         -providerclass com.oracle.jipher.provider.JipherJCE 
         -providerpath $CLASSPATH
       

2. Set the Java system properties used by the default SSL context when booting WebLogic Server. You can do this by setting the following Java options in the WebLogic Server start script as described in Specifying Java Options for a WebLogic Server Instance in Administering Server Startup and Shutdown for Oracle WebLogic Server.
   For example:

   Set JAVA_OPTIONS=”-Djavax.net.ssl.trustStore=/u01/jdk/jre/lib/security/cacerts.p12 -Djavax.net.ssl.trustStoreType=PKCS12”