--- schema_version: "1" id: 1e7cbae553bf080160935b81d36e696f181be888a68e222496fc6579128bd586 title: FIPS 140-3 Compliance Support collection: mulesoft version: current locale: en-us portal_url: https://docs.salesforce.com/mulesoft/current/en-us/mule-runtime/4.9/fips-140-3-compliance-support.md canonical_url: https://docs.mulesoft.com/mule-runtime/4.9/fips-140-3-compliance-support source_site: docs.mulesoft.com content_type: documentation content_hash: fb85805990f5d76e2d6ec4a54681f873e6a6351261463fab62fbb8911a7c3e28 description: MuleSoft Documentation Site release: "4.9" latest: false --- --- product: Mule Runtime version: 4.9 keywords: fips, certifications, security, fips-140-3 --- # FIPS 140-3 Compliance Support > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Run Mule 4 in a Federal Information Processing Standard (FIPS) 140-3 certified environment by enabling approved cryptography providers and runtime settings. Use this guide to install BC-FJA, enable FIPS mode, and configure TLS and keystore formats for compliant deployments. These steps help you meet federal cryptography requirements while keeping runtime behavior predictable across environments. Mule doesn’t run in FIPS security mode by default. To use FIPS security mode: - Install a certified cryptography module in your Java environment. - Adjust Mule runtime settings to run in FIPS security mode. ## Compatibility FIPS 140-3 support requires: - Mule 4.9.17 or later (for earlier versions of Mule runtime, use [FIPS 140-2 Compliance Support](https://docs.mulesoft.com/mule-runtime/4.9/fips-140-2-compliance-support)) - Java 17 or later - FIPS license from the license `.zip` file provided by MuleSoft (the non-FIPS license isn’t valid for FIPS mode) ## Assumptions This document assumes you’re familiar with [FIPS 140-3](https://csrc.nist.gov/publications/detail/fips/140/3/final), the US government security standard that requires that compliant parties use only cryptographic algorithms and techniques that have been certified by NIST. These instructions use BC-FJA, the recommended FIPS 140-3 certified security provider for Mule runtime ([Certificate #4943](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4943)). If you use a different [certified security provider](https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules), refer to that provider’s documentation for configuration instructions. ## Installing BC-FJA Security Provider Mule runtime uses BC-FJA 2.1.2 as its FIPS 140-3 certified cryptography provider. ### Installation Steps These instructions show how to install and configure BC-FJA security provider in Java 17 or later. 1. Verify that you’re using Java 17 or later and `JAVA_HOME` is set. 2. Download the BC-FJA 2.1.2 provider files from [the BouncyCastle website](https://www.bouncycastle.org/fips-java/). 3. Copy the required JAR files to the `${MULE_HOME}/lib/boot` folder: bc-fips-2.1.2.jar bcutil-fips-2.1.5.jar bctls-fips-2.1.22.jar bcpkix-fips-2.1.10.jar 4. Configure the security properties in `java.security`. - Security providers: security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider security.provider.2=org.bouncycastle.jsse.provider.BouncyCastleJsseProvider fips:BCFIPS > [!NOTE] On ARM64 (AArch64) architectures, register the `SUN` provider. BC-FJA 2.1.2 doesn’t > include a `SecureRandom` implementation for AArch64 (its native cryptographic library > targets x86\_64 only). The JVM’s `securerandom.strongAlgorithms` property defaults to > `NativePRNGBlocking:SUN` and `DRBG:SUN`. Without a provider that supplies these algorithms, > the JVM fails during early bootstrap, before Mule logs initialize. > > Add `SUN` as security provider 3: > > security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider > security.provider.2=org.bouncycastle.jsse.provider.BouncyCastleJsseProvider fips:BCFIPS > security.provider.3=SUN 5. Set the key manager and trust manager algorithms: ssl.KeyManagerFactory.algorithm=PKIX ssl.TrustManagerFactory.algorithm=PKIX 6. Set the keystore type: keystore.type=FIPS ## Running Mule in FIPS Security Mode After installing the BC-FJA provider, configure Mule to run in FIPS 140-3 mode: 1. Open your `wrapper.conf` file (located in `${MULE_HOME}/conf`). 2. Add these properties. Replace `` with the next sequential number in your file: \# Enable FIPS 140-3 security mode wrapper.java.additional.=-Dmule.security.model=fips140-3 # Enable Bouncy Castle approved-only mode wrapper.java.additional.=-Dorg.bouncycastle.fips.approved\_only=true # Required for Java 17+ module access wrapper.java.additional.=--add-opens=java.base/sun.security.provider=org.bouncycastle.fips.core # Set keystore type to BCFKS wrapper.java.additional.=-Dmule.keystore.type=BCFKS 3. If you’re using a clustered environment, also add the cluster encryption key: wrapper.java.additional.=-Dmule.cluster.network.encryption.key={your-encryption-key} For more information about clustering in FIPS mode, see [Cluster reference](https://docs.mulesoft.com/on-premises/latest/mule-high-availability-ha-clusters#cluster_fips). 4. Save your changes and start Mule runtime. > [!IMPORTANT] In FIPS-compliant environments, all keystores and truststores typically require BCFKS > format. To support legacy JKS stores, such as the default Java truststore at > `${JAVA_HOME}/lib/security/cacerts`, see > [FIPS 140-3 Compliant Keystore Formats](#fips-140-3-compliant-keystore-formats) for configuration > options. When Mule launches, the startup logs show that FIPS 140-3 security mode is enabled. Mule automatically restricts protocol negotiations to use only approved cryptographic cipher suites. > [!IMPORTANT] Not all connectors are FIPS 140-3 compliant. Only connectors tagged as > `fips-140-3-verified` in Anypoint Exchange are certified to use in FIPS 140-3 environments. Always > verify compliance in Exchange before deploying. ## FIPS 140-3 Compliant Cipher Suites These cipher suites are enabled by default when running Mule in FIPS 140-3 mode. ### TLS 1.3 Cipher Suites - TLS\_AES\_128\_GCM\_SHA256 - TLS\_AES\_256\_GCM\_SHA384 - TLS\_AES\_128\_CCM\_SHA256 - TLS\_AES\_128\_CCM\_8\_SHA256 ### TLS 1.2 Cipher Suites - TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256 - TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256 - TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_GCM\_SHA384 - TLS\_DHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384 - TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384 - TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA384 - TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA384 - TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA - TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA - TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA - TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA > [!NOTE] These cipher suites are configured in the `${MULE_HOME}/conf/tls-fips140-3.conf` file. > FIPS 140-3 requires support for TLS 1.3 and TLS 1.2. Earlier TLS versions aren’t supported. ## FIPS 140-3 Compliant Keystore Formats Keystores or truststores in non-FIPS environments are typically formatted as `PKCS12` or `JKS`. These formats aren’t FIPS-compliant. Convert them to `BCFKS` format. 1. Use this example command to convert a `JKS` keystore to `BCFKS` format. If the source keystore is `PKCS12`, set `-srcstoretype` to `PKCS12` in the `keytool` command: BC\_FIPS\_JAR=${MULE\_HOME}/lib/boot/bc-fips-2.1.2.jar # Replace with a correct path OLD\_KEYSTORE="keystore.jks" # Replace with the keystore to convert OLD\_PASSWD="changeit" # Replace with the keystore password NEW\_KEYSTORE="keystore.bcfks" # Replace with the new keystore NEW\_PASSWD="changeit" # Replace with the new keystore password keytool -importkeystore \\ -providerclass sun.security.provider.Sun \\ -providerclass org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider \\ -providerpath ${BC\_FIPS\_JAR} \\ -srckeystore ${OLD\_KEYSTORE} -srcstoretype JKS -srcstorepass ${OLD\_PASSWD} \\ -destkeystore ${NEW\_KEYSTORE} -deststoretype BCFKS -deststorepass ${NEW\_PASSWD} 2. Update the [TLS configuration](https://docs.mulesoft.com/mule-runtime/4.9/tls-configuration) in your Mule application to use the new keystore or truststore: 3. By default, the JVM truststore at `${JAVA_HOME}/lib/security/cacerts` is a `JKS`. There are two approaches to handle this special case: - Convert to BCFKS - Convert the `JKS` store to `BCFKS` using the `keytool` command as described in [FIPS 140-3 Compliant Keystore Formats](#fips-140-3-compliant-keystore-formats), pointing OLD\_KEYSTORE to `${JAVA_HOME}/lib/security/cacerts` and NEW\_KEYSTORE to `${JAVA_HOME}/lib/security/cacerts.bcfks` - Add these properties to your `wrapper.conf` file: wrapper.java.additional.=-Djavax.net.ssl.trustStore=${JAVA\_HOME}/lib/security/cacerts.bcfks wrapper.java.additional.=-Djavax.net.ssl.trustStorePassword=changeit wrapper.java.additional.=-Djavax.net.ssl.trustStoreType=bcfks - Allow legacy `JKS` store - Add this property to your `wrapper.conf` file: wrapper.java.additional.=-Dorg.bouncycastle.jca.enable\_jks=true ## Connectors Compatibility Only connectors tagged as `fips-140-3-verified` in Anypoint Exchange are certified for use in FIPS 140-3 environments. To check compliance in Exchange before deploying: 1. Open Anypoint Exchange. 2. Search for the connector. 3. Check for the `fips-140-3-verified` tag. ## Tips and Limitations - Not all encryption schemes and signatures are FIPS 140-3 compliant. If your application uses a non-approved algorithm, you get this runtime error: Could not find encryption algorithm ''. You are running in FIPS mode, so please verify that the algorithm is compliant with FIPS. - Different environments can have different security configurations. Test before deploying to production. ## See Also - [Validated FIPS 140-3 Cryptographic Modules](https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules) - [FIPS 140-3 Standard](https://csrc.nist.gov/publications/detail/fips/140/3/final) - [FIPS 140-2 Compliance Support](https://docs.mulesoft.com/mule-runtime/4.9/fips-140-2-compliance-support)