FIPS 140-2 Configuration with Oracle Application Server and Oracle HTTP Server 10g (Doc ID 473029.1)

Last updated on JANUARY 17, 2017

Applies to:

Oracle HTTP Server - Version 10.1.2.0.0 to 10.1.3.5.0 [Release AS10gR2 to AS10gR3]
Oracle Fusion Middleware - Version 10.1.2.0.0 to 10.1.4.3.0 [Release AS10gR2 to AS10gR3]
Information in this document applies to any platform.
Oracle Application Server 10g Enterprise Edition - Version: 10.1.2.0.0 to 10.1.4.2.0
Oracle Application Server 10g Enterprise Edition - Version: 10.1.2.0.0 to 10.1.3.4.0


Goal

FIPS 140-2 Configuration with Oracle Application Server and Oracle HTTP Server 10g

This document will outline steps to enable FIPS 140-2 on the Oracle Application Server 10g and configure FIPS 140-2 on Oracle HTTP Server installed with the following:

The following steps are outlined in this document:

Important:

The steps herein are outlined to combine all steps involved, covering desired SSL configuration, documentation references for all versions, necessary Oracle Application Server 10g Patch Sets, Critical Patch Update requirements, and Oracle Documentation of FIPS 140-2 steps.

For a streamlined list of steps and/or for troubleshooting applicable to all platforms and versions, see the Quick FIPS 140-2 Test.

On some versions and platforms, there are one-off patches across different components. When applied, the Oracle Application Server components will work together to be FIPS 140-2 compliant.  These are noted within the steps as alternative choices. However, the availability may be limited or fixes may conflict with Critical Patch Updates.

Beginning with CPUJul2008, all fixes have been back-ported and merged on all platforms for versions 10.1.2.2, 10.1.2.3, 10.1.3.1, 10.1.3.3, and 10.1.3.4.

Note that if a separate Oracle Database is used, the only requirement is that a CPU patch should be applied to the Database Server before applying a CPU patch to any Application Server homes. This is not a FIPS requirement, but a CPU requirement.

Solution

Sign In with your My Oracle Support account

Don't have a My Oracle Support account? Click to get started

My Oracle Support provides customers with access to over a
Million Knowledge Articles and hundreds of Community platforms