JMXFetch FIPS-140 mode

문서 > 통합 > 통합 지침 > JMXFetch FIPS-140 mode

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

JMXFetch supports FIPS-140 compliant JVM configurations. It uses the default JSSE provider of the Java runtime environment for all encrypted communications, including:

TLS communication with Datadog Agent
SSL connections to JMX endpoints (when configured)

Requirements

JVM configured to run in FIPS mode.
Datadog FIPS Agent installed on the host.
Appropriate TLS/SSL certificates if encrypted JMX connection is required.

Note: The Datadog Agent host installation does not include Java runtime. You must install and configure Java in FIPS-approved mode separately.

Datadog FIPS Agent Docker image with JMX support.
Appropriate TLS/SSL certificates if encrypted JMX connection is required. (Private keys must be generated with the keytool utility provided in the container. See Generating certificates for more details.)

Note: Datadog Agent FIPS JMX Docker images include OpenJDK pre-configured to run in FIPS-approved mode.

Setting up encrypted JMX connections

This section demonstrates how to configure mutual TLS (mTLS) using self-signed certificates.

Generating certificates

Mutual TLS (mTLS) requires valid certificates to be presented by both the server (the Java application’s JMX connector) and the client (JMXFetch).

Commands provided in this section are for reference only and should be adjusted based on your specific scenario.

Configure the JVM in FIPS mode before generating certificates, as some Java FIPS modules reject private keys created in non-FIPS mode.

Create a directory for key and trust stores and make it the current directory.

Create two new certificates in two new key stores:

keytool -keystore java-app-keystore -genkey -alias java-app -dname CN=java-app -validity 365 -keyalg ec -storepass changeit
keytool -keystore jmxfetch-keystore -genkey -alias jmxfetch -dname CN=jmxfetch -validity 365 -keyalg ec -storepass changeit

Export public parts of the generated certificates to separate files:

keytool -keystore java-app-keystore -export -alias java-app -rfc -file java-app-cert.pem -storepass changeit
keytool -keystore jmxfetch-keystore -export -alias jmxfetch -rfc -file jmxfetch-cert.pem -storepass changeit

Import certificates into corresponding trust stores to make them trusted:

keytool -keystore java-app-truststore -import -alias jmxfetch -file jmxfetch-cert.pem -storepass changeit -noprompt
keytool -keystore jmxfetch-truststore -import -alias java-app -file java-app-cert.pem -storepass changeit -noprompt

Container installations must use BCFKS key store format. Use the keytool utility from the Datadog Agent FIPS JMX Docker image for JMXFetch certificates, and the Java application’s keytool utility for application certificates.

Create a directory for key and trust stores and make it the current directory.

Create two new certificates in two new key stores:

keytool -keystore java-app-keystore -genkey -alias java-app -dname CN=java-app -validity 365 -keyalg ec -storepass changeit

docker run --rm -v $(pwd):/ssl datadog/agent:latest-fips-jmx \
  keytool -keystore /ssl/jmxfetch-keystore -genkey -alias jmxfetch -dname CN=jmxfetch -validity 365 -keyalg ec -storepass changeit -keypass changeit

Export public parts of the generated certificates to separate files:

keytool -keystore java-app-keystore -export -alias java-app -rfc -file java-app-cert.pem -storepass changeit

docker run --rm -v $(pwd):/ssl datadog/agent:latest-fips-jmx \
  keytool -keystore /ssl/jmxfetch-keystore -export -alias jmxfetch -rfc -file /ssl/jmxfetch-cert.pem -storepass changeit

Import certificates into corresponding trust stores to make them trusted:

keytool -keystore java-app-truststore -import -alias jmxfetch -file jmxfetch-cert.pem -storepass changeit -noprompt

docker run --rm -v $(pwd):/ssl datadog/agent:latest-fips-jmx \
  keytool -keystore /ssl/jmxfetch-truststore -import -alias java-app -file /ssl/java-app-cert.pem -storepass changeit -noprompt

Configuring the Java application

See application documentation for specific instructions about how to configure JMX properties. Add these JMX properties to your application configuration. Adjust the paths to your key and trust store files.

com.sun.management.jmxremote.ssl=true
com.sun.management.jmxremote.registry.ssl=true
com.sun.management.jmxremote.ssl.need.client.auth=true
javax.net.ssl.keyStore=/ssl/java-app-keystore
javax.net.ssl.keyStorePassword=changeit
javax.net.ssl.trustStore=/ssl/java-app-truststore
javax.net.ssl.trustStorePassword=changeit

Configuring JMXFetch

Add this configuration to your JMXFetch configuration file:

init_config:
  is_jmx: true
instances:
  - host: <HOST>
    port: <PORT>
    name: my-java-app
    rmi_registry_ssl: true
    key_store_path: /ssl/jmxfetch-keystore
    key_store_password: changeit
    trust_store_path: /ssl/jmxfetch-truststore
    trust_store_password: changeit