# ElasticSearch FIPS (BouncyCastle)

**URL:** <https://discuss.elastic.co/t/elasticsearch-fips-bouncycastle/303298>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [April 26, 2022, 2:46pm UTC](https://discuss.elastic.co/t/elasticsearch-fips-bouncycastle/303298 "2022-04-26T14:46:05Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [April 28, 2022, 3:47am UTC](https://discuss.elastic.co/t/elasticsearch-fips-bouncycastle/303298/6 "2022-04-28T03:47:19Z")

</div>

> [@datencio](#):
>
> this is basically my JAVA policy, from hat I can tell there is nothing wrong with it,

I can't comment on that but I trust you followed the link I shared with you and applied the needed policy changes.

> [2022-04-27T18:55:21,919][WARN][stderr] [node-1] at org.bouncycastle.jsse.provider.ProvTrustManagerFactorySpi.getDefaultTrustStore(ProvTrustManagerFactorySpi.java:112)

It might be that you need to also convert the default truststore ( cacerts ) that comes with the JDK to BCFKS and set a password for it and then load it explicitly by passing

```auto
-Djavax.net.ssl.trustStore=path/to/cacerts.bcfks -Djavax.net.ssl.keyStore=path/to/cacerts.bcfks -Djavax.net.ssl.keyStoreType=BCFKS -Djavax.net.ssl.trustStorePassword=thepasswordyouset -Djavax.net.ssl.keyStorePassword=thepasswordyouset

```

as [extra JVM options](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/advanced-configuration.html#set-jvm-options)  
Which also reminds me that you need to pass `-Dorg.bouncycastle.fips.approved_only=true` too as a JVM arg

Finally, please note that we take no responsibility for the correctness of this configuration and whether or not this leads to your environment being compliant and I still strongly suggest that you speak with someone that is an expert on the matter.

---

_[View the full topic](https://discuss.elastic.co/t/elasticsearch-fips-bouncycastle/303298)._