stianst · Sep 25, 2026 · Sep 25, 2026
@@ -126,7 +126,7 @@ When starting the server, you can check that the startup log contains `KC` provi
 
 [source]
 ----
-FIPS1402Provider created: KC(BCFIPS version 2.0102 Approved Mode, FIPS-JVM: enabled)
+FIPS1402Provider created: KC(BCFIPS version 2.0103 Approved Mode, FIPS-JVM: enabled)
 ----
 
 === Cryptography restrictions in strict mode
@@ -294,3 +294,20 @@ see the https://access.redhat.com/documentation/en-us/red_hat_build_of_openjdk/2
 You can check the {project_name} server log at startup to see if the correct security providers are used. TRACE logging should be enabled for crypto-related {project_name} packages as described in the Keycloak startup command earlier.
 
 </@tmpl.guide>
+
+
+== Troubleshooting
+
+BouncyCastle FIPS requires TLS certificates with a Subject Alternative Name (SAN), with no fallback to using
+the Common Name (CN) from the certificate. Due to an issue in older versions of BouncyCastle FIPS the fallback was
+enabled by default, which is no longer the case.
+
+If you see an error such as `No hostname specified for HTTPS endpoint ID check` the recommended solution is to
+update the certificates to include a Subject Alternative Name (SAN).
+
+As an alternative temporary solution enable the Common Name (CN) fallback with:
+
+[source, bash]
+----
+export JAVA_OPTS_APPEND="-Dorg.bouncycastle.jsse.hostname_check_cn_fallback=true"
+----
@@ -78,10 +78,10 @@
         <!-- Versions used mostly for Undertow server, aligned with WildFly -->
         <jboss.dmr.version>1.5.1.Final</jboss.dmr.version>
 
-        <bouncycastle.pkixfips.version>2.1.10</bouncycastle.pkixfips.version>
-        <bouncycastle.bcfips.version>2.1.2</bouncycastle.bcfips.version>
-        <bouncycastle.bctls-fips.version>2.1.22</bouncycastle.bctls-fips.version>
-        <bouncycastle.bcutilfips.version>2.1.5</bouncycastle.bcutilfips.version>
+        <bouncycastle.pkixfips.version>2.1.13</bouncycastle.pkixfips.version>
+        <bouncycastle.bcfips.version>2.1.3</bouncycastle.bcfips.version>
+        <bouncycastle.bctls-fips.version>2.1.25</bouncycastle.bctls-fips.version>
+        <bouncycastle.bcutilfips.version>2.1.8</bouncycastle.bcutilfips.version>
 
         <dom4j.version>2.1.3</dom4j.version>
        <h2.version>2.4.240</h2.version>

@@ -35,7 +35,7 @@
 @Tag(DistributionTest.SLOW)
 public class FipsDistTest {
 
-    private static final String BCFIPS_VERSION = "BCFIPS version 2.0102";
+    private static final String BCFIPS_VERSION = "BCFIPS version 2.0103";
 
     @Test
     void testFipsNonApprovedMode(KeycloakDistribution dist) {