Error FIPS mode: only SunJSSE TrustManagers may be used

[jordanpadams]

Checked for duplicates

No - I haven't checked

🐛 Describe the bug

When I tried loading some data from my linux machine, harvest fails with this error

🕵️ Expected behavior

I expected it to work

📜 To Reproduce

$ harvest -c $HARVEST_CONFIG --archive-status=archived --overwrite
...
2025-07-15 12:41:27 [ERROR] (HarvestCli.java:runCommand:98) FIPS mode: only SunJSSE TrustManagers may be used

🖥 Environment Info

openjdk version "11.0.25" 2024-10-15 LTS
OpenJDK Runtime Environment (Red_Hat-11.0.25.0.9-1.0.1) (build 11.0.25+9-LTS)
OpenJDK 64-Bit Server VM (Red_Hat-11.0.25.0.9-1.0.1) (build 11.0.25+9-LTS, mixed mode, sharing)

📚 Version of Software Used

Harvest version: 4.0.7
Build time: 2025-04-21T17:21:28Z

🩺 Test Data / Additional context

No response

🦄 Related requirements

🦄 #xyz

⚙️ Engineering Details

Most likely a java configuration thing that we will want to document

🎉 Integration & Test

No response

[al-niessner]

@jordanpadams

Let me understand this better because I upload all the time and have no trouble. First, uploading to AOSS or local opensearch in a docker container?

[jordanpadams]

@al-niessner AOSS

[al-niessner]

@jordanpadams

The trust manager is for certificates that it receives like self signed ones in particular. With certificates that can be resolved through a server like the AWS certificates, the trust manager is not necessary. Other than a bad proxy, I cannot think how the trust manager would be invoked via AWS certificates. Your proxy/firewall would allow access to AWS but not the national certificate center where AWS registers its root.

[al-niessner]

@jordanpadams

Did you turn on FIPS? Are you sure AOSS certificate is FIPS compliant? It still does not make sense that resolving a server certificate that did not use a FIPS compliant algorithm would default to the trust manager. It still will not be compliant.

[jordanpadams]

@al-niessner this is production AOSS, and no one else is encountering this issue, so it seems like it may be localized to this system.

[jordanpadams]

Maybe a java configuration?

[al-niessner]

I think you have FIPS turned on while the rest of us do not. I think that is the root of the problem.

…

On Tue, Jul 15, 2025, 14:13 Jordan Padams ***@***.***> wrote: *jordanpadams* left a comment (NASA-PDS/registry#440) <#440> Maybe a java configuration? — Reply to this email directly, view it on GitHub <#440>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAIUBIUGXAVXZB37N6AXU333IVVHNAVCNFSM6AAAAACBS47P26VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTANZVGY4DCMZSG4> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[tloubrieu-jpl]

@al-niessner @jordanpadams I can try turning FIPS off in the JDK now.

[tloubrieu-jpl]

It is loading now. Thanks @al-niessner that is a good catch.

I updated the harvest sh file:

"$JAVA" "$TOOL_JAR" $@

Became:

"$JAVA" -Dcom.redhat.fips=false -jar "$TOOL_JAR" $@

That might not be the best fix for a long term solution... Unless with think we should always have that turned off, in which case, I would do a PR for that change.

[tloubrieu-jpl]

I would need to check if JDK_JAVA_OPTIONS environment variable is used by java cmd under hood. It is not used in the harvest script but if java is using it, that would be a better solution.

I will let the current run conclude before I test that.

[tloubrieu-jpl]

I confirm command:

export JDK_JAVA_OPTIONS='-Dcom.redhat.fips=false'

Before launching harvest, fixes the issue.

I still need to add that in the documentation.