Some more tweaks to 6313675 are necessary. In FIPS mode, we should also ensure that:

 . we only use the random number generator from the FIPS crypto provider
 . crypto operations during certificate verification (in particular signature verification) happen using the FIPS crypto provider
 . we only use private keys/certs stored in the crypto provider for authentication.