stianst · Sep 23, 2026 · Sep 23, 2026
@@ -126,7 +126,7 @@ When starting the server, you can check that the startup log contains `KC` provi
 
 [source]
 ----
-FIPS1402Provider created: KC(BCFIPS version 2.0102 Approved Mode, FIPS-JVM: enabled)
+FIPS1402Provider created: KC(BCFIPS version 2.0103 Approved Mode, FIPS-JVM: enabled)
 ----
 
 === Cryptography restrictions in strict mode

@@ -106,6 +106,11 @@ private void createLdapContext() throws NamingException {
                     sslSocketFactory = provider.getSSLSocketFactory();
                 }
 
+                // Wrap factory to ensure SNI hostname is set for endpoint verification
+                if (sslSocketFactory != null) {
+                    sslSocketFactory = new SNIAwareSSLSocketFactory(sslSocketFactory);
+                }
+
                 tlsResponse = startTLS(ldapContext, sslSocketFactory);
 
                 // Exception should be already thrown by LDAPContextManager.startTLS if "startTLS" could not be established, but rather do some additional check
@@ -292,6 +297,71 @@ public static Hashtable<Object, Object> getNonAuthConnectionProperties(LDAPConfi
         return new Hashtable<>(env);
     }
 
+    private static class SNIAwareSSLSocketFactory extends javax.net.ssl.SSLSocketFactory {
+        private final javax.net.ssl.SSLSocketFactory delegate;
+
+        SNIAwareSSLSocketFactory(javax.net.ssl.SSLSocketFactory delegate) {
+            this.delegate = delegate;
+        }
+
+        @Override
+        public String[] getDefaultCipherSuites() {
+            return delegate.getDefaultCipherSuites();
+        }
+
+        @Override
+        public String[] getSupportedCipherSuites() {
+            return delegate.getSupportedCipherSuites();
+        }
+
+        @Override
+        public java.net.Socket createSocket(java.net.Socket socket, String host, int port, boolean autoClose) throws java.io.IOException {
+            return setSNI(delegate.createSocket(socket, host, port, autoClose), host);
+        }
+
+        @Override
+        public java.net.Socket createSocket(String host, int port) throws java.io.IOException {
+            return setSNI(delegate.createSocket(host, port), host);
+        }
+
+        @Override
+        public java.net.Socket createSocket(String host, int port, java.net.InetAddress localHost, int localPort) throws java.io.IOException {
+            return setSNI(delegate.createSocket(host, port, localHost, localPort), host);
+        }
+
+        @Override
+        public java.net.Socket createSocket(java.net.InetAddress address, int port) throws java.io.IOException {
+            return delegate.createSocket(address, port);
+        }
+
+        @Override
+        public java.net.Socket createSocket(java.net.InetAddress address, int port, java.net.InetAddress localAddress, int localPort) throws java.io.IOException {
+            return delegate.createSocket(address, port, localAddress, localPort);
+        }
+
+        @Override
+        public java.net.Socket createSocket() throws java.io.IOException {
+            return delegate.createSocket();
+        }
+
+        private static java.net.Socket setSNI(java.net.Socket socket, String hostname) {
+            if (hostname != null && socket instanceof javax.net.ssl.SSLSocket) {
+                try {
+                    javax.net.ssl.SSLSocket sslSocket = (javax.net.ssl.SSLSocket) socket;
+                    javax.net.ssl.SSLParameters params = sslSocket.getSSLParameters();
+                    if (params == null) {
+                        params = new javax.net.ssl.SSLParameters();
+                    }
+                    params.setServerNames(java.util.Collections.singletonList(new javax.net.ssl.SNIHostName(hostname)));
+                    sslSocket.setSSLParameters(params);
+                } catch (Exception e) {
+                    logger.debugf("Failed to set SNI hostname '%s' for LDAP TLS: %s", hostname, e.getMessage());
+                }
+            }
+            return socket;
+        }
+    }
+
     @Override
     public void close() {
         if (tlsResponse != null) {

@@ -74,10 +74,10 @@
         <!-- Versions used mostly for Undertow server, aligned with WildFly -->
         <jboss.dmr.version>1.5.1.Final</jboss.dmr.version>
 
-        <bouncycastle.pkixfips.version>2.1.10</bouncycastle.pkixfips.version>
-        <bouncycastle.bcfips.version>2.1.2</bouncycastle.bcfips.version>
-        <bouncycastle.bctls-fips.version>2.1.22</bouncycastle.bctls-fips.version>
-        <bouncycastle.bcutilfips.version>2.1.5</bouncycastle.bcutilfips.version>
+        <bouncycastle.pkixfips.version>2.1.13</bouncycastle.pkixfips.version>
+        <bouncycastle.bcfips.version>2.1.3</bouncycastle.bcfips.version>
+        <bouncycastle.bctls-fips.version>2.1.25</bouncycastle.bctls-fips.version>
+        <bouncycastle.bcutilfips.version>2.1.8</bouncycastle.bcutilfips.version>
 
         <dom4j.version>2.1.3</dom4j.version>
         <h2.version>2.4.240</h2.version>

@@ -36,7 +36,7 @@
 @Tag(DistributionTest.SLOW)
 public class FipsDistTest {
 
-    private static final String BCFIPS_VERSION = "BCFIPS version 2.0102";
+    private static final String BCFIPS_VERSION = "BCFIPS version 2.0103";
 
     @Test
     void testFipsNonApprovedMode(KeycloakRunner runner) {