stianst · Sep 25, 2026
diff --git a/docs/guides/server/fips.adoc b/docs/guides/server/fips.adoc
@@ -126,7 +126,7 @@ When starting the server, you can check that the startup log contains `KC` provi
 
 [source]
 ----
-FIPS1402Provider created: KC(BCFIPS version 2.0102 Approved Mode, FIPS-JVM: enabled)
+FIPS1402Provider created: KC(BCFIPS version 2.0103 Approved Mode, FIPS-JVM: enabled)
 ----
 
 === Cryptography restrictions in strict mode
@@ -294,3 +294,20 @@ see the https://access.redhat.com/documentation/en-us/red_hat_build_of_openjdk/2
 You can check the {project_name} server log at startup to see if the correct security providers are used. TRACE logging should be enabled for crypto-related {project_name} packages as described in the Keycloak startup command earlier.
 
 </@tmpl.guide>
+
+
+== Troubleshooting
+
+BouncyCastle FIPS requires TLS certificates with a Subject Alternative Name (SAN), with no fallback to using
+the Common Name (CN) from the certificate. Due to an issue in older versions of BouncyCastle FIPS the fallback was
+enabled by default, which is no longer the case.
+
+If you see an error such as `No hostname specified for HTTPS endpoint ID check` the recommended solution is to
+update the certificates to include a Subject Alternative Name (SAN).
+
+As an alternative temporary solution enable the Common Name (CN) fallback with:
+
+[source, bash]
+----
+export JAVA_OPTS_APPEND="-Dorg.bouncycastle.jsse.hostname_check_cn_fallback=true"
+----
diff --git a/pom.xml b/pom.xml
@@ -74,10 +74,10 @@
         <!-- Versions used mostly for Undertow server, aligned with WildFly -->
         <jboss.dmr.version>1.5.1.Final</jboss.dmr.version>
 
-        <bouncycastle.pkixfips.version>2.1.10</bouncycastle.pkixfips.version>
-        <bouncycastle.bcfips.version>2.1.2</bouncycastle.bcfips.version>
-        <bouncycastle.bctls-fips.version>2.1.22</bouncycastle.bctls-fips.version>
-        <bouncycastle.bcutilfips.version>2.1.5</bouncycastle.bcutilfips.version>
+        <bouncycastle.pkixfips.version>2.1.13</bouncycastle.pkixfips.version>
+        <bouncycastle.bcfips.version>2.1.3</bouncycastle.bcfips.version>
+        <bouncycastle.bctls-fips.version>2.1.25</bouncycastle.bctls-fips.version>
+        <bouncycastle.bcutilfips.version>2.1.8</bouncycastle.bcutilfips.version>
 
         <dom4j.version>2.1.3</dom4j.version>
         <h2.version>2.4.240</h2.version>

diff --git a/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/FipsDistTest.java b/quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/FipsDistTest.java
@@ -36,7 +36,7 @@
 @Tag(DistributionTest.SLOW)
 public class FipsDistTest {
 
-    private static final String BCFIPS_VERSION = "BCFIPS version 2.0102";
+    private static final String BCFIPS_VERSION = "BCFIPS version 2.0103";
 
     @Test
     void testFipsNonApprovedMode(KeycloakRunner runner) {

diff --git a/tests/base/src/test/resources/keycloak-truststore.bcfks b/tests/base/src/test/resources/keycloak-truststore.bcfks
diff --git a/tests/base/src/test/resources/keycloak-truststore.pem b/tests/base/src/test/resources/keycloak-truststore.pem
@@ -110,3 +110,30 @@ p4xNlwocSs+Fhjqsf6L5AvAc8fLP1206f/lp/9qEnvD0kocw2KvxwZY2yDtf115z
 aHxhil32iWME340LVSYyQZqwPPr3N2t4CGZsgGs8vPXLECAGqrT3V2/I3iZNF3J5
 i0GE63/1Q35BPHxPAJcqB/a5woBwo/Ae40u6qWR15keFp3UaJ0M/C9GR
 -----END CERTIFICATE-----
+Bag Attributes
+    friendlyName: localhost
+    localKeyID: 54 69 6D 65 20 31 37 39 30 32 36 36 31 34 31 37 37 35 
+subject=C=US, ST=MA, L=Westword, O=Red Hat, OU=Keycloak, CN=localhost
+issuer=C=US, ST=MA, L=Westword, O=Red Hat, OU=Keycloak, CN=localhost
+-----BEGIN CERTIFICATE-----
+MIIDjzCCAnegAwIBAgIJALWqyptL7iHLMA0GCSqGSIb3DQEBDAUAMGYxCzAJBgNV
+BAYTAlVTMQswCQYDVQQIEwJNQTERMA8GA1UEBxMIV2VzdHdvcmQxEDAOBgNVBAoT
+B1JlZCBIYXQxETAPBgNVBAsTCEtleWNsb2FrMRIwEAYDVQQDEwlsb2NhbGhvc3Qw
+HhcNMjYwOTI0MTQzMjE3WhcNNDgwNjMwMTQzMjE3WjBmMQswCQYDVQQGEwJVUzEL
+MAkGA1UECBMCTUExETAPBgNVBAcTCFdlc3R3b3JkMRAwDgYDVQQKEwdSZWQgSGF0
+MREwDwYDVQQLEwhLZXljbG9hazESMBAGA1UEAxMJbG9jYWxob3N0MIIBIjANBgkq
+hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlxc1r41FVJpdf8+ukT9j8QmKoKsY4lIx
+7UnJFY55bH5Q2Vo1jzbVS4JDU/qKjMi7vnYuEXLto46znHd/aoQ5alm/M/jZuDJh
+uwqCfDvAvYooYQ8tSFmJc5uK2W4RmlqOA4vj1bYGl0JxYYqQTw7f9yHX7lON51VC
+uGMq20wY5thbLniZ1hOq46g/kGeC+zL6YjdgGCBARbhz/hWPHpceBSfrq9V+O26F
+6aRMQelHJMn18TMLcQREqCkGh++SFEEStOJXRBWNJCGd6fORBdqCkJWcH8IV628Q
+qicBvzizp0KeSx7NUDLK8XOyeA3Qk2Ltdje+WjfURO6NCWtZivNOgwIDAQABo0Aw
+PjAdBgNVHQ4EFgQUvGa1TMD9LYX9YMHgw3e8I8jSaYAwHQYDVR0RAQH/BBMwEYIJ
+bG9jYWxob3N0hwR/AAABMA0GCSqGSIb3DQEBDAUAA4IBAQAIO0RUlQwLrykXyu5a
+yo1gKvQNHx0JN3k46L3OdEXw4ZqJ67+4CZ6SP0ogywLum1auq4j7IrDzQTaZj0lC
+AJ52HlfJXT0Yu9pDakw/8x4yI20w1B3FdNOVP/Ha+fkUmxzb0592r5YzoUcqa3pu
+MQqG54gOcCkqJ7cjGC7JBfy4Ux4kolCZFajQG6G8Q8KwGR9Gxqp4TvorfM99k2Cq
+D98LzX8hyK9Sze2SdXQY4UtNTxFI5AxbDQSrnfExR2qwObxAmV90djmEqjW8aEEs
+e9nZbwGdnMepmuutv65t19JNUuCzpE7vUHjuIFcurAVM5qrlsZLxT6+GOUfjH8/F
+YwGN
+-----END CERTIFICATE-----
diff --git a/tests/base/src/test/resources/keycloak.bcfks b/tests/base/src/test/resources/keycloak.bcfks
diff --git a/...suite/integration-arquillian/servers/app-server/jboss/common/keystore/keycloak.truststore b/...suite/integration-arquillian/servers/app-server/jboss/common/keystore/keycloak.truststore
diff --git a/...suite/integration-arquillian/servers/auth-server/common/fips/keycloak-fips.keystore.bcfks b/...suite/integration-arquillian/servers/auth-server/common/fips/keycloak-fips.keystore.bcfks
diff --git a/...uite/integration-arquillian/servers/auth-server/common/fips/keycloak-fips.keystore.pkcs12 b/...uite/integration-arquillian/servers/auth-server/common/fips/keycloak-fips.keystore.pkcs12
diff --git a/...ite/integration-arquillian/servers/auth-server/common/fips/keycloak-fips.truststore.bcfks b/...ite/integration-arquillian/servers/auth-server/common/fips/keycloak-fips.truststore.bcfks
diff --git a/...te/integration-arquillian/servers/auth-server/common/fips/keycloak-fips.truststore.pkcs12 b/...te/integration-arquillian/servers/auth-server/common/fips/keycloak-fips.truststore.pkcs12
diff --git a/testsuite/integration-arquillian/servers/auth-server/common/keystore/keycloak.jks b/testsuite/integration-arquillian/servers/auth-server/common/keystore/keycloak.jks
diff --git a/testsuite/integration-arquillian/servers/auth-server/common/keystore/keycloak.truststore b/testsuite/integration-arquillian/servers/auth-server/common/keystore/keycloak.truststore
diff --git a/testsuite/integration-arquillian/tests/base/src/test/resources/keystore/keycloak.jks b/testsuite/integration-arquillian/tests/base/src/test/resources/keystore/keycloak.jks
diff --git a/testsuite/integration-arquillian/tests/base/src/test/resources/keystore/keycloak.truststore b/testsuite/integration-arquillian/tests/base/src/test/resources/keystore/keycloak.truststore