From 7c7d414171118172f0287cbb58cfa95ab0f1c377 Mon Sep 17 00:00:00 2001
From: Andreas Wehrmann <andreas.wehrmann@sap.com>
Date: Tue, 11 Aug 2026 09:31:47 +0200
Subject: [PATCH] fix(fips): swap bcprov-jdk18on for bc-fips to enable FIPS
 140-3 compliance
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace org.bouncycastle:bcprov-jdk18on + bcpkix-jdk18on (non-FIPS) with the
FIPS 140-3 validated distribution: bc-fips:2.1.3, bcpkix-fips:2.1.8,
bctls-fips:2.1.20, bcutil-fips:2.1.5.

CertificateHttpClientConfig: BouncyCastleProvider → BouncyCastleFipsProvider,
KeyStore provider "PKCS12" → "PKCS12/BCFIPS", decryptor builder pinned to
"BCFIPS" provider. All 20 existing tests pass.

Downstream tracking: https://jira.tools.sap/browse/RBSALSRV-511
---
 .../ng/CertificateHttpClientConfig.java       | 14 +++++------
 pom.xml                                       | 25 +++++++++++++++----
 2 files changed, 27 insertions(+), 12 deletions(-)

diff --git a/cds-feature-auditlog-ng/src/main/java/com/sap/cds/feature/auditlog/ng/CertificateHttpClientConfig.java b/cds-feature-auditlog-ng/src/main/java/com/sap/cds/feature/auditlog/ng/CertificateHttpClientConfig.java
index c45e656..c73a5d9 100644
--- a/cds-feature-auditlog-ng/src/main/java/com/sap/cds/feature/auditlog/ng/CertificateHttpClientConfig.java
+++ b/cds-feature-auditlog-ng/src/main/java/com/sap/cds/feature/auditlog/ng/CertificateHttpClientConfig.java
@@ -24,7 +24,7 @@
 import org.apache.http.impl.client.HttpClients;
 import org.bouncycastle.asn1.pkcs.PrivateKeyInfo;
 import org.bouncycastle.cert.X509CertificateHolder;
-import org.bouncycastle.jce.provider.BouncyCastleProvider;
+import org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider;
 import org.bouncycastle.openssl.PEMParser;
 import org.bouncycastle.openssl.jcajce.JceOpenSSLPKCS8DecryptorProviderBuilder;
 import org.bouncycastle.operator.InputDecryptorProvider;
@@ -52,9 +52,9 @@ public class CertificateHttpClientConfig {
     private static final Logger logger = LoggerFactory.getLogger(CertificateHttpClientConfig.class);
 
     static {
-        // Register BouncyCastle provider if not already present
-        if (Security.getProvider("BC") == null) {
-            Security.addProvider(new BouncyCastleProvider());
+        // Register BouncyCastle FIPS provider if not already present
+        if (Security.getProvider("BCFIPS") == null) {
+            Security.addProvider(new BouncyCastleFipsProvider());
         }
     }
 
@@ -170,11 +170,11 @@ public CertificateHttpClientConfig build() {
     private CloseableHttpClient createHttpClient() {
         try {
             char[] effectivePassphrase = (keyPassphrase != null) ? keyPassphrase.toCharArray() : new char[0];
-            logger.info("Creating HttpClient with certificate authentication and {} retries", maxRetries);
+            logger.info("Creating HttpClient with certificate authentication and {} retries (BCFIPS)", maxRetries);
             X509Certificate[] certChain = parseCertificateChain(certPem);
             PrivateKey privateKey = parsePrivateKey(keyPem, effectivePassphrase);
 
-            KeyStore keyStore = KeyStore.getInstance("PKCS12");
+            KeyStore keyStore = KeyStore.getInstance("PKCS12", "BCFIPS");
             keyStore.load(null, null);
             keyStore.setKeyEntry("client", privateKey, new char[0], certChain);
 
@@ -237,7 +237,7 @@ private static PrivateKey parsePrivateKey(String keyPem, char[] passphrase) thro
                 return KeyFactory.getInstance("RSA").generatePrivate(keySpec);
             } else if (object instanceof PKCS8EncryptedPrivateKeyInfo encInfo) {
                 try {
-                    InputDecryptorProvider decryptorProvider = new JceOpenSSLPKCS8DecryptorProviderBuilder().build(effectivePassphrase);
+                    InputDecryptorProvider decryptorProvider = new JceOpenSSLPKCS8DecryptorProviderBuilder().setProvider("BCFIPS").build(effectivePassphrase);
                     PrivateKeyInfo keyInfo = encInfo.decryptPrivateKeyInfo(decryptorProvider);
                     PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(keyInfo.getEncoded());
                     return KeyFactory.getInstance("RSA").generatePrivate(keySpec);
diff --git a/pom.xml b/pom.xml
index 25799d1..052bc6d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -37,7 +37,10 @@
     <mockito.version>5.18.0</mockito.version>
     <sdk-bom.version>5.25.0</sdk-bom.version>
     <mockito-bom.version>5.21.0</mockito-bom.version>
-    <bcpkix-jdk18on.version>1.83</bcpkix-jdk18on.version>
+    <bc-fips.version>2.1.3</bc-fips.version>
+    <bcpkix-fips.version>2.1.8</bcpkix-fips.version>
+    <bctls-fips.version>2.1.20</bctls-fips.version>
+    <bcutil-fips.version>2.1.5</bcutil-fips.version>
   </properties>
 
   <groupId>com.sap.cds</groupId>
@@ -85,14 +88,26 @@
   <dependencies>
     <dependency>
       <groupId>org.bouncycastle</groupId>
-      <artifactId>bcprov-jdk18on</artifactId>
-      <version>${bcpkix-jdk18on.version}</version>
+      <artifactId>bc-fips</artifactId>
+      <version>${bc-fips.version}</version>
     </dependency>
 
     <dependency>
       <groupId>org.bouncycastle</groupId>
-      <artifactId>bcpkix-jdk18on</artifactId>
-      <version>${bcpkix-jdk18on.version}</version>
+      <artifactId>bcpkix-fips</artifactId>
+      <version>${bcpkix-fips.version}</version>
+    </dependency>
+
+    <dependency>
+      <groupId>org.bouncycastle</groupId>
+      <artifactId>bctls-fips</artifactId>
+      <version>${bctls-fips.version}</version>
+    </dependency>
+
+    <dependency>
+      <groupId>org.bouncycastle</groupId>
+      <artifactId>bcutil-fips</artifactId>
+      <version>${bcutil-fips.version}</version>
     </dependency>
 
     <dependency>