--- schema_version: "1" id: 013b8c745527097524acb0f92d8196628f190328c15e5551bddbf21de0149c8d title: FIPS 140-3 Compliance Support in Government Cloud collection: mulesoft version: current locale: en-us portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gov-cloud/gov-cloud-fips-140-3-support.md canonical_url: https://docs.mulesoft.com/gov-cloud/gov-cloud-fips-140-3-support source_site: docs.mulesoft.com content_type: documentation content_hash: 39c4c0cfdfdd201d557196b17b5131b954bc57460ad80867d9d3baecac409912 description: MuleSoft Documentation Site latest: true --- --- product: MuleSoft Government Cloud keywords: fips, certifications, security, fips-140-3, government cloud --- # FIPS 140-3 Compliance Support in Government Cloud > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Configure Mule runtime engine (Mule) to run in a Federal Information Processing Standard (FIPS) 140-3 certified environment in MuleSoft Government Cloud. Mule doesn’t run in FIPS security mode by default. To enable it, you must: - Install a certified cryptography module in your Java environment. - Adjust Mule runtime settings to run in FIPS security mode. Follow the migration path that matches your scenario: - [Migrating Mule from FIPS 140-2 to FIPS 140-3](#migrate-fips1402-to-fips1403) - [Migrating Mule from Non-FIPS to FIPS 140-3](#migrate-non-fips-to-fips1403) ## Compatibility FIPS 140-3 support in MuleSoft Government Cloud requires: - Mule runtime engine 4.9 (Government Cloud supported version) - Java 17 or later - FIPS license from the license `.zip` file provided by MuleSoft (the non-FIPS license isn’t valid for FIPS mode) ## Assumptions This document assumes you are familiar with [FIPS 140-3](https://csrc.nist.gov/publications/detail/fips/140/3/final), the US government security standard that requires compliant parties to use only cryptographic algorithms and techniques certified by NIST. These instructions use Bouncy Castle 2.0.0, the recommended FIPS 140-3 certified security provider for Mule runtime. If you use a different [certified security provider](https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules), refer to that provider’s documentation for configuration instructions. ## Migrating from FIPS 140-2 to FIPS 140-3 If you are currently running Mule in FIPS 140-2 mode and want to move to FIPS 140-3, apply these cipher and configuration changes. ### Cipher and Protocol Changes - TLS and cipher suites: FIPS 140-3 requires support for TLS 1.3 and TLS 1.2. Earlier TLS versions aren’t supported. Use only the FIPS 140-3 compliant cipher suites listed in the [FIPS 140-3 Compliant Cipher Suites](#fips-140-3-compliant-cipher-suites) section. Remove or replace any custom TLS or cipher configuration that references FIPS 140-2-only or non–FIPS 140-3 cipher suites. - Configuration file: FIPS 140-3 uses the `$MULE_HOME/conf/tls-fips140-3.conf` file for TLS cipher configuration. Ensure your runtime uses this file and that you have removed or replaced references to any FIPS 140-2 TLS configuration file. ### Security Provider and Java Configuration - Bouncy Castle version: Replace the FIPS 140-2 Bouncy Castle provider (typically 1.x FIPS) with Bouncy Castle 2.0.0 FIPS. Install the JARs listed in [Installing Bouncy Castle Security Provider](#set_up_environment) and update `java.security` to use `BouncyCastleFipsProvider` and `BouncyCastleJsseProvider` as shown there. - `KeyManagerFactory` and `TrustManagerFactory`: In `$JAVA_HOME/conf/security/java.security`, set: ssl.KeyManagerFactory.algorithm=PKIX ssl.TrustManagerFactory.algorithm=PKIX ### Runtime Configuration (wrapper.conf) - Security model: Change the Mule security model from FIPS 140-2 to FIPS 140-3: \# Enable FIPS 140-3 security mode (replace fips140-2) wrapper.java.additional.=-Dmule.security.model=fips140-3 - Approved-only mode: Add or ensure: wrapper.java.additional.=-Dorg.bouncycastle.fips.approved\_only=true - Java 17+ module access: Add: wrapper.java.additional.=--add-opens=java.base/sun.security.provider=org.bouncycastle.fips.core ### Keystore Format - BCFKS: FIPS 140-3 requires keystores and truststores in `BCFKS` format. If you are still using `PKCS12` or `JKS` from your FIPS 140-2 setup, convert them to `BCFKS` using the steps in [FIPS 140-3 Compliant Keystore Formats](#fips-140-3-compliant-keystore-formats). Update all TLS contexts in your Mule apps to reference the new keystores and set `type="bcfks"`. ### Connectors and Post-Migration - Use only connectors tagged as `fips-140-3-verified` in Anypoint Exchange. Replace or remove connectors that are only verified for FIPS 140-2. - Restart Mule after all changes and confirm in startup logs that FIPS 140-3 security mode is enabled. ## Migrating from Non-FIPS to FIPS 140-3 If you are running Mule in standard (non-FIPS) mode and need to move directly to FIPS 140-3, complete these steps. ### Prerequisites - Mule runtime engine 4.9 - Java 17 or later - A FIPS license from the license `.zip` file provided by MuleSoft. ### Steps 1. Install the FIPS 140-3 certified cryptography provider: Follow [Installing Bouncy Castle Security Provider](#set_up_environment) to install Bouncy Castle 2.0.0 FIPS and configure `java.security` (providers and `ssl.KeyManagerFactory.algorithm` / `ssl.TrustManagerFactory.algorithm`). 2. Configure Mule for FIPS 140-3 mode: In `$MULE_HOME/conf/wrapper.conf`, add the properties described in [Running Mule in FIPS Security Mode](#running-mule-in-fips-security-mode) (`mule.security.model=fips140-3`, `org.bouncycastle.fips.approved_only=true`, and the `--add-opens` option). For Mule 4.9, set the keystore type explicitly: wrapper.java.additional.=-Dmule.keystore.type=BCFKS 3. Convert keystores and truststores to BCFKS: Standard Mule setups often use `PKCS12` or `JKS`. Convert all keystores and truststores used by your applications to `BCFKS` using the procedure in [FIPS 140-3 Compliant Keystore Formats](#fips-140-3-compliant-keystore-formats). 4. Update TLS configuration in Mule apps: In your Mule configuration files, update every `tls:context` to use the new BCFKS keystores and truststores with `type="bcfks"` as shown in [FIPS 140-3 Compliant Keystore Formats](#fips-140-3-compliant-keystore-formats). 5. Remove non-compliant cipher and protocol usage: Don’t configure custom cipher suites or TLS versions that aren’t FIPS 140-3 compliant. Rely on the default FIPS 140-3 cipher suites (see [FIPS 140-3 Compliant Cipher Suites](#fips-140-3-compliant-cipher-suites)) and ensure no connectors or custom code force non-approved algorithms. 6. Verify connector compliance: Only use connectors tagged as `fips-140-3-verified` in Anypoint Exchange. Replace or remove any connector that isn’t FIPS 140-3 verified (see [Connectors Compatibility](#connectors-compatibility)). 7. Restart Mule and validate: Save all changes, restart Mule, and confirm in startup logs that FIPS 140-3 security mode is enabled. Test connectivity and integrations that use TLS and cryptography. ## Installing Bouncy Castle Security Provider Mule runtime uses Bouncy Castle 2.0.0 as its FIPS 140-3 certified cryptography provider. ### Installation Steps These instructions show how to install and configure the Bouncy Castle security provider with Java 17 or later. 1. Verify that you are using Java 17 or later and `JAVA_HOME` is set. 2. Download the Bouncy Castle 2.0.0 provider files from [the Bouncy Castle website](https://www.bouncycastle.org/fips-java/). 3. Copy the required JAR files to the `$MULE_HOME/lib/boot` folder: bc-fips-2.0.0.jar bctls-fips-2.0.19.jar bcpkix-fips-2.0.7.jar bcutil-fips-2.0.3.jar bcpg-fips-2.0.9.jar bcjmail-fips-2.0.5.jar 4. Configure the security providers in the `$JAVA_HOME/conf/security/java.security` file: security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider security.provider.2=org.bouncycastle.jsse.provider.BouncyCastleJsseProvider fips:BCFIPS security.provider.3=SUN 5. Configure the key manager and trust manager algorithms in the same `java.security` file: ssl.KeyManagerFactory.algorithm=PKIX ssl.TrustManagerFactory.algorithm=PKIX ## Running Mule in FIPS Security Mode After installing the Bouncy Castle provider, configure Mule to run in FIPS 140-3 mode: 1. Open your `wrapper.conf` file (located in `$MULE_HOME/conf`). 2. Add these properties. Replace `` with the next sequential number in your file: \# Enable FIPS 140-3 security mode wrapper.java.additional.=-Dmule.security.model=fips140-3 # Enable Bouncy Castle approved-only mode wrapper.java.additional.=-Dorg.bouncycastle.fips.approved\_only=true # Required for Java 17+ module access wrapper.java.additional.=--add-opens=java.base/sun.security.provider=org.bouncycastle.fips.core # For Mule 4.9: set keystore type to BCFKS wrapper.java.additional.=-Dmule.keystore.type=BCFKS 3. If you are using a clustered environment, also add the cluster encryption key: wrapper.java.additional.=-Dmule.cluster.network.encryption.key={your-encryption-key} 4. Save your changes and start Mule runtime. When Mule launches, the startup logs show that FIPS 140-3 security mode is enabled. Mule automatically restricts protocol negotiations to use only approved cryptographic cipher suites. > [!IMPORTANT] Not all connectors are FIPS 140-3 compliant. Only connectors tagged as > `fips-140-3-verified` in Anypoint Exchange are certified for use in FIPS 140-3 environments. > Always verify compliance in Exchange before deploying. ## FIPS 140-3 Compliant Cipher Suites These cipher suites are enabled by default when running Mule in FIPS 140-3 mode. Use these when planning or validating migrations from FIPS 140-2 or non-FIPS runtimes. ### TLS 1.3 Cipher Suites - TLS\_AES\_128\_GCM\_SHA256 - TLS\_AES\_256\_GCM\_SHA384 - TLS\_AES\_128\_CCM\_SHA256 - TLS\_AES\_128\_CCM\_8\_SHA256 ### TLS 1.2 Cipher Suites - TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256 - TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256 - TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_GCM\_SHA384 - TLS\_DHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384 - TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384 - TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA384 - TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA384 - TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA - TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA - TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA - TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA > [!NOTE] These cipher suites are configured in the `$MULE_HOME/conf/tls-fips140-3.conf` file. FIPS > 140-3 requires support for TLS 1.3 and TLS 1.2. Earlier TLS versions aren’t supported. ## FIPS 140-3 Compliant Keystore Formats Keystores or truststores in Mule apps are often formatted as `PKCS12` or `JKS`. These formats aren’t FIPS compliant. For compliance, convert them to `BCFKS` format: 1. Download the `bc-fips-2.0.0.jar` file from the [Bouncy Castle website](https://www.bouncycastle.org/download/bouncy-castle-java-fips/). 2. Use this example command to convert a keystore to `BCFKS` format: BC\_FIPS\_JAR=${BC\_PATH}/bc-fips-2.0.0.jar # Replace with a correct path OLD\_KEYSTORE="keystore.jks" # Replace with the keystore to convert OLD\_PASSWD="changeit" # Replace with the keystore password NEW\_KEYSTORE="keystore.bcfks" # Replace with the new keystore NEW\_PASSWD="changeit" # Replace with the new keystore password keytool -importkeystore \\ -providerclass org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider \\ -providerpath ${BC\_FIPS\_JAR} \\ -srckeystore ${OLD\_KEYSTORE} -srcstoretype JKS -srcstorepass ${OLD\_PASSWD} \\ -destkeystore ${NEW\_KEYSTORE} -deststoretype BCFKS -deststorepass ${NEW\_PASSWD} > [!NOTE] If the source keystore is `PKCS12`, set `-srcstoretype` to `PKCS12` in the `keytool` > command. 4. Update the TLS configuration in your Mule configuration file to use the new keystore or truststore: ## Connectors Compatibility Only connectors tagged as `fips-140-3-verified` in Anypoint Exchange are certified for use in FIPS 140-3 environments. To check compliance in Exchange before deploying: 1. Open Anypoint Exchange. 2. Search for the connector. 3. Check for the `fips-140-3-verified` tag. ## Tips and Limitations - Not all encryption schemes and signatures are FIPS 140-3 compliant. If your app uses a non-approved algorithm, you might see a runtime error such as: Could not find encryption algorithm ''. You are running in FIPS mode, so please verify that the algorithm is compliant with FIPS. - Different environments can have different security configurations. Test before deploying to production. ## See Also - [Security in MuleSoft Government Cloud](https://docs.mulesoft.com/gov-cloud/gov-cloud-security) - [Government Cloud Overview](https://docs.mulesoft.com/gov-cloud/)