Concepts

Various forms of encryption must be enabled by modifying the ctsrvr.cfg server configuration file.

TLS support is controlled by a set of entries within SUBSYSTEM COMM_PROTOCOL SSL.

Support for file level encryption is initialized by keywords such as:

And the FIPS version of these methods is enabled by

See Configure server to use certificate for details.

File-level encryption must still be enabled on a file-by-file basis, either by conversion for existing files or at file creation. Consult the relevant programmers guide for details or contact FairCom support for assistance.

When a FairCom server starts with FIPS enabled, the CTSTATUS.FCS log file contains the following message: OpenSSL FIPS Cryptographic provider in use

FIPS communicates using TCP/IP.

To force all ISAM, CTDB, and SQL communications to use TLS, disable shared memory communications by commenting out or removing the COMM_PROTOCOL FSHAREMM line in the ctsrvr.cfg server configuration file:

;COMM_PROTOCOL FSHAREMM

The FairCom FIPS library can be used to verify that TCP/IP communications use FIPS-compliant TLS connections. On Microsoft Windows, the FIPS library is fips.dll. On Linux it is libfips.so. Copy the appropriate file from the<faircom>/server directory into your client application area and include it in your application's distribution.

Start the FairCom client driver in FIPS mode by setting the FAIRCOM_FIPS_CLIENT_MODE environment variable to YES.

When the FairCom client driver starts in FIPS mode, it loads the OpenSSL FIPS module (fips.dll or libfips.so) from its working directory. If the FIPS library fails to load, the FairCom driver returns error 1182 to the client software.

FIPS initialization creates the mandatory configuration file ./faircomssl.cnf, if it does not already exist.  If a new version of the FIPS library is deployed then the old faircomssl.cnf must be deleted. This client environment configuration applies to all connections using FairCom DB SQL drivers and FairCom DB client libraries. Some FairCom DB client libraries, such as the Java-based CTDB and JTDB drivers, the Microsoft .NET CTDB driver, and the Python CTDB driver, use the FairCom mtclient.dll (.so .dylib) library interface to connect with the database. Client software using these drivers must enable FIPS by setting the environment variable FAIRCOM_FIPS_CLIENT_MODE=YES. 

Client software using FairCom ISAM, CTDB, and SQL protocols can turn on the logging of FIPS diagnostic messages to verify FIPS status by adding the following environment variable to a log file:

FAIRCOM_FIPS_CLIENT_LOG = my_fips.log

The following errors may occur when a client is connecting to a server.