java-17-openjdk/nss.fips.cfg.in

name = NSS-FIPS
nssLibraryDirectory = @NSS_LIBDIR@
nssSecmodDirectory = sql:/etc/pki/nssdb
nssDbMode = readOnly
nssModule = fips

attributes(*,CKO_SECRET_KEY,CKK_GENERIC_SECRET)={ CKA_SIGN=true }
Initial load 2021-12-07 14:45:09 +00:00			`name = NSS-FIPS`
			`nssLibraryDirectory = @NSS_LIBDIR@`
			`nssSecmodDirectory = sql:/etc/pki/nssdb`
			`nssDbMode = readOnly`
			`nssModule = fips`

RH2007331: SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode Use SunPKCS11 Attributes Configuration to set CKA_SIGN=true on SecretKey generate/import operations in FIPS mode, see: https://docs.oracle.com/en/java/javase/17/security/pkcs11-reference-guide1.html#GUID-C4ABFACB-B2C9-4E71-A313-79F881488BB9__PKCS11-ATTRIBUTES-CONFIGURATION 2022-06-30 16:51:25 +00:00			`attributes(*,CKO_SECRET_KEY,CKK_GENERIC_SECRET)={ CKA_SIGN=true }`