We recently (version 6.1.2) introduced 3 new connection properties for FIPS mode: fips, trustStoreType, fipsProvider. The implementation assumes fipsProvider contains trustStoreType when calling Keystore.getInstance(trustStoreType,fipsProvider). However, not all providers that contain FIPS-complaint algorithms also provide keystores, such as IBMJCEFIPS. See this page. In this case, users have to use non-FIPS IBMJCE provider (IBMJCE) to store the keys, which means they also have to set fipsProvider=IBMJCE. This can be confusing, because IBMJCE is not the actual FIPS provider, but it is the provider that contains keystore.

Below are a few possible solutions to solve the issue and we would really appreciate any feedback from the community.

1. Keep the current implementation and update the documentation describing the differences. This way we would not be introducing breaking changes, but the connection property fipsProvider could still be confusing to users because of the naming.
2. Rename the connection property fipsProvider to trustStoreProvider. This would break the existing FIPS applications, but the name of the property would be less confusing.
3. Remove the connection property fipsProvider. If provider is not specified, Keystore.getInstance(trustStoreType) traverses the list of registered providers and creates a new instance of matching Keystore. So, instead of creating a new Keystore from the specified provider, the driver would create it from the most preferred (the one that comes first in security providers list) provider. This would obviously be a breaking change too, but also would let us avoid any possible confusions.

I am also posting links to the related PRs below.

#97
#135
#325
#433

We would appreciate opinions on the proposed solutions. Please feel free to let us know if you have other suggestions 👍