Learn about Security and Auditing

Prepare databases

Save PDF

Save PDF

To prepare a database to run in FIPS mode, you must:

Shut down the database.
Update cryptography algorithms to remove deprecated ciphers, which cause FIPS validation to fail.
1. Use any of the following PROUTIL qualifiers to identify deprecated ciphers:
  - PROUTIL DESCRIBE—Identifies if the database is using any deprecated DMK and object ciphers.
  - PROUTIL EPOLICY VIEW—all parameter shows what ciphers are in use for all objects.
  - PROUTIL EPOLICY INFO—Shows each cipher in use and whether it is supported or deprecated.
  Note: DES3_CBC_168 is supported in OpenEdge but is not available in FIPS mode, so you should change it when removing deprecated ciphers.
2. Update deprecated ciphers using the PROUTIL EPOLICY MANAGE command.
Use either the PROUTIL AUDITLOAD or PROUTIL AUDITARCHIVE command to update the seal of any records that were sealed with the MD5 hash algorithm. This seal is no longer supported and cannot be read, once FIPS mode is enabled.