BouncyCastle Error integrating with Keycloak: java.lang.ClassNotFoundException: org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider #38959

sourabh-kalel · 2025-04-15T06:16:47Z

sourabh-kalel
Apr 15, 2025

I am trying to integrate BouncyCastle library for our applications enabling FIPS compliance and trying to use it's Strong Algorithm of SecureRandom for DRBG keypair generation. Following the keycloak documentation over the same - https://www.keycloak.org/server/fips. We are correctly including the bc-fips-*.jar files into the keycloak provider via docker using this - COPY --chown=1000 "files/*.jar" /opt/keycloak/providers/

This is the keytool command I am using -
keytool -keystore /opt/keycloak/conf/server.keystore -storetype bcfks -providername BCFIPS -providerpath /opt/keycloak/providers/bc-fips-2.1.0.jar -providerclass /opt/keycloak/providers/org/bouncycastle/jcajce/provider/BouncyCastleFipsProvider.java -provider org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider -alias localhost -genkeypair -sigalg SHA512withRSA -keyalg RSA -validity 730 -storepass ******** -dname CN=localhost -keypass ********** -J-Djava.security.properties=/opt/keycloak/custom_configs/kc.java.security -J-Dorg.bouncycastle.fips.approved_only=true -J-Djava.security.debug=all

but it throws an error of -

92.23 ProviderConfig: Found SL Provider named SunSASL
92.23 ProviderConfig: Loading legacy provider: org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
92.23 ProviderConfig: Error loading legacy provider org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
92.23 java.lang.ClassNotFoundException: org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
92.23 	at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:641)
92.23 	at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:188)
92.23 	at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:525)
92.23 	at java.base/sun.security.jca.ProviderConfig$ProviderLoader.legacyLoad(ProviderConfig.java:392)
92.23 	at java.base/sun.security.jca.ProviderConfig$ProviderLoader.load(ProviderConfig.java:369)
92.23 	at java.base/sun.security.jca.ProviderConfig$3.run(ProviderConfig.java:254)
92.23 	at java.base/sun.security.jca.ProviderConfig$3.run(ProviderConfig.java:248)
92.23 	at java.base/java.security.AccessController.doPrivileged(AccessController.java:318)
92.23 	at java.base/sun.security.jca.ProviderConfig.doLoadProvider(ProviderConfig.java:248)
92.23 	at java.base/sun.security.jca.ProviderConfig.getProvider(ProviderConfig.java:226)
92.23 	at java.base/sun.security.jca.ProviderList.loadAll(ProviderList.java:317)
92.23 	at java.base/sun.security.jca.ProviderList.removeInvalid(ProviderList.java:334)
92.23 	at java.base/sun.security.jca.Providers.getFullProviderList(Providers.java:186)
92.23 	at java.base/java.security.Security.insertProviderAt(Security.java:414)
92.23 	at java.base/java.security.Security.addProvider(Security.java:457)
92.23 	at java.base/sun.security.tools.KeyStoreUtil.loadProviderByClass(KeyStoreUtil.java:333)
92.23 	at java.base/sun.security.tools.keytool.Main.doCommands(Main.java:840)
92.23 	at java.base/sun.security.tools.keytool.Main.run(Main.java:423)
92.23 	at java.base/sun.security.tools.keytool.Main.main(Main.java:416)
92.23 ProviderConfig: Error loading provider org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
92.23 Provider: SUN.putService(): SUN: SecureRandom.NativePRNG -> sun.security.provider.NativePRNG
92.23   attributes: {ThreadSafe=true}
92.23 
92.23 Provider: Add SecureRandom algo NativePRNG
92.23 Provider: SUN.putService(): SUN: SecureRandom.NativePRNGBlocking -> sun.security.provider.NativePRNG$Blocking
92.23   attributes: {ThreadSafe=true}

And in the end it starts to take up - sun.security.provider.NativePRNG which is not a FIPS approved RNG keypair algorithm.

Which finally leads to this error -
org.bouncycastle.crypto.fips.FipsUnapprovedOperationError: Attempt to create key pair with unapproved RNG: EC

Our java security file looks something like this -

security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
security.provider.2=sun.security.provider.Sun

securerandom.source = DRBG
securerandom.strongAlgorithms=DRBG, BCFIPS

Basically I think if we resolve this - java.lang.ClassNotFoundException: org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider then it should start taking up DRBG, BCFIPS algo to create the FIPS approved keypairs.
If anyone has worked around making your application FIPS compliant using BC or has an idea on this please let me know.

Flpvoigt · 2026-09-30T19:40:30Z

Flpvoigt
Sep 30, 2026

The immediate problem is the value passed to -providerclass: it must be the fully qualified Java class name, not a path to a .java file. The class is already compiled inside the JAR.

Use one provider declaration:

keytool -keystore /opt/keycloak/conf/server.keystore \
  -storetype bcfks -providername BCFIPS \
  -providerpath /opt/keycloak/providers/bc-fips-2.1.0.jar \
  -providerclass org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider \
  -alias localhost -genkeypair -sigalg SHA512withRSA -keyalg RSA \
  -validity 730 -storepass '...' -keypass '...' -dname CN=localhost

Remove the -providerclass /opt/.../BouncyCastleFipsProvider.java argument and the second abbreviated -provider option. Verify the class exists with jar tf /opt/keycloak/providers/bc-fips-2.1.0.jar | grep BouncyCastleFipsProvider.

Also avoid registering BCFIPS as security.provider.1 for this keytool step before the JAR is on the normal JVM classpath; load it explicitly through -providerpath/-providerclass as above. The SUN/NativePRNG fallback happens because BCFIPS failed to load, not because the DRBG setting was ignored.

0 replies

Navigation Menu

Repository navigation

BouncyCastle Error integrating with Keycloak: java.lang.ClassNotFoundException: org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider #38959

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

BouncyCastle Error integrating with Keycloak: java.lang.ClassNotFoundException: org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider #38959

Uh oh!

Uh oh!

sourabh-kalel Apr 15, 2025

Replies: 1 comment

Uh oh!

Flpvoigt Sep 30, 2026

sourabh-kalel
Apr 15, 2025

Flpvoigt
Sep 30, 2026