# Exception while enabling fips in es7.17
**URL:** https://discuss.elastic.co/t/exception-while-enabling-fips-in-es7-17/354642
**Category:** Elasticsearch
**Created:** [March 4, 2024, 12:57pm UTC](https://discuss.elastic.co/t/exception-while-enabling-fips-in-es7-17/354642 "2024-03-04T12:57:10Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@navaneethan](https://discuss.elastic.co/u/navaneethan)
#### Post date: [March 4, 2024, 12:57pm UTC](https://discuss.elastic.co/t/exception-while-enabling-fips-in-es7-17/354642/1 "2024-03-04T12:57:10Z")
While enabling the fips with the below config param we are facing
```auto
xpack.security.fips_mode.enabled: true
xpack.security.authc.password_hashing.algorithm: pbkdf2_10000
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.client_authentication: required
#xpack.security.transport.ssl.keystore.path: certs/elastic-certificates.p12
#xpack.security.transport.ssl.truststore.path: certs/elastic-certificates.p12
```
closing connection io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: no cipher suites in common
we also tried the below param addition, but facing the same issue
```auto
xpack.security.http.ssl.cipher_suites: ["TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"]
```
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [March 5, 2024, 4:45am UTC](https://discuss.elastic.co/t/exception-while-enabling-fips-in-es7-17/354642/2 "2024-03-05T04:45:22Z")
Which JSSE library are you using?
Have you installed a FIPS certified security provider?
---
### Author:  [@navaneethan](https://discuss.elastic.co/u/navaneethan)
#### Post date: [March 5, 2024, 7:10am UTC](https://discuss.elastic.co/t/exception-while-enabling-fips-in-es7-17/354642/3 "2024-03-05T07:10:32Z")
Hi @TimV
We are using FIPS installed OS
```auto
ua status
SERVICE ENTITLED STATUS DESCRIPTION
anbox-cloud yes disabled Scalable Android in the cloud
esm-apps yes enabled Expanded Security Maintenance for Applications
esm-infra yes enabled Expanded Security Maintenance for Infrastructure
fips yes enabled NIST-certified FIPS crypto packages
fips-updates yes disabled FIPS compliant crypto packages with stable security updates
usg yes disabled Security compliance and audit tools
For a list of all Ubuntu Pro services, run 'pro status --all'
Enable services with: pro enable
Account: pre-profit-fedramp
Subscription: pre-profit-fedramp
Valid until: Thu Dec 30 16:00:00 9999 PST
Technical support level: essential
```
```auto
cat /proc/sys/crypto/fips_enabled
1
```
we are using
```auto
java -version
java version "1.8.0_131"
Java(TM) SE Runtime Environment (build 1.8.0_131-b11)
Java HotSpot(TM) 64-Bit Server VM (build 25.131-b11, mixed mode)
```
---
### Author:  [@navaneethan](https://discuss.elastic.co/u/navaneethan)
#### Post date: [March 5, 2024, 11:10am UTC](https://discuss.elastic.co/t/exception-while-enabling-fips-in-es7-17/354642/4 "2024-03-05T11:10:18Z")
Hi @dadoonet and @DavidTurner could you please help us on this
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [March 5, 2024, 11:22am UTC](https://discuss.elastic.co/t/exception-while-enabling-fips-in-es7-17/354642/5 "2024-03-05T11:22:06Z")
Please be patient in waiting for responses to your question and refrain from pinging multiple times asking for a response or opening multiple topics for the same question. This is a community forum, it may take time for someone to reply to your question. For more information please refer to the [Community Code of Conduct](https://www.elastic.co/community/codeofconduct) specifically the section "Be patient". **Also, please refrain from pinging folks directly** , this is a forum and anyone that participates might be able to assist you.
If you are in need of a service with an SLA that covers response times for questions then you may want to consider talking to us about a [subscription](https://www.elastic.co/subscriptions).
It's fine to answer on your own thread after 2 or 3 days (not including weekends) if you don't have an answer.
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [March 6, 2024, 12:07am UTC](https://discuss.elastic.co/t/exception-while-enabling-fips-in-es7-17/354642/6 "2024-03-06T00:07:54Z")
From what you've shown it doesn't look like your Java SDK is configured for FIPS, but I don't know exactly what Ubuntu might be doing under the covers.
My guess is that Ubuntu's JDK packages for FIPS are configured to use non-default settings and have disable certain TLS ciphers.
Elasticsearch's FIPS mode officially only [supports](https://www.elastic.co/support/matrix#matrix_jvm) running on the Oracle JDK with Bouncy Castle FIPS
> FIPS 140-2 mode requires Oracle JDK 11 and the Bouncy Castle BCJSSE FIPS security provider
I suspect your issues are coming from using a different FIPS-enabled JDK.
---
### Author:  [@navaneethan](https://discuss.elastic.co/u/navaneethan)
#### Post date: [March 21, 2024, 11:51am UTC](https://discuss.elastic.co/t/exception-while-enabling-fips-in-es7-17/354642/7 "2024-03-21T11:51:53Z")
Hi @TimV
For enabling the fips mode, is it mandatory to go oracle jdk 11 or any other open jdk as per the support matrix
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [March 21, 2024, 11:37pm UTC](https://discuss.elastic.co/t/exception-while-enabling-fips-in-es7-17/354642/8 "2024-03-21T23:37:02Z")
If you want support, then you need to stick to what is listed on the support matrix.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 18, 2024, 11:37pm UTC](https://discuss.elastic.co/t/exception-while-enabling-fips-in-es7-17/354642/9 "2024-04-18T23:37:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.