A DESCRIPTION OF THE REQUEST :
Attempting to use BouncyCastle's FIPS-140-2 approved crypto provider causes an exception to be thrown in the JarVerifier initializer. This causes other problems because javax.crypto.JceSecurity cannot therefore be loaded.

The problem arises because JarVerifier apparently uses certificates signed with MD5withRSA as part of JarVerifier's initialization checking. MD5withRSA is not an approved algorithm in BouncyCastle's FIPS 140-2 "approved only mode" which leads to initialization failure.

BouncyCastle FIPS info: https://www.bouncycastle.org/fips-java/

JUSTIFICATION :
The SunPKCS11 provider has become outdated is no longer a viable option for FIPS 140-2 operation. (Among other things, TLSv2 cannot be used because of unavailable algorithms.)

BouncyCastle's FIPS-certified solution is therefore the current likely candidate for FIPS 140-2 mode using Java. However, using BC does not allow the standard Oracle JRE to function because of JRE classes' use of outdated algorithms.

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
JarVerifier should use data signed with an approved algorithm for JarVerifier's initialization checks. E.g., SHA256withRSA.

ACTUAL -
JarVerifier uses MD5withRSA resulting in the following exception (using the provided test code):

java.lang.ExceptionInInitializerError
        at javax.crypto.JceSecurity.loadPolicies(JceSecurity.java:317)
        at javax.crypto.JceSecurity.setupJurisdictionPolicies(JceSecurity.java:262)
        at javax.crypto.JceSecurity.access$000(JceSecurity.java:48)
        at javax.crypto.JceSecurity$1.run(JceSecurity.java:80)
        at java.security.AccessController.doPrivileged(Native Method)
        at javax.crypto.JceSecurity.<clinit>(JceSecurity.java:77)
        at javax.crypto.Mac.getInstance(Mac.java:176)
        at BCDemo.main(BCDemo.java:12)
Caused by: java.lang.SecurityException: Framework jar verification can not be initialized
        at javax.crypto.JarVerifier.<clinit>(JarVerifier.java:228)
        ... 8 more
Caused by: java.security.PrivilegedActionException: java.security.NoSuchAlgorithmException: 1.2.840.113549.1.1.4 Signature not available
        at java.security.AccessController.doPrivileged(Native Method)
        at javax.crypto.JarVerifier.<clinit>(JarVerifier.java:186)
        ... 8 more
Caused by: java.security.NoSuchAlgorithmException: 1.2.840.113549.1.1.4 Signature not available
        at java.security.Signature.getInstance(Signature.java:229)
        at org.bouncycastle.jcajce.provider.X509CertificateObject.getSignatureFromProvider(Unknown Source)
        at org.bouncycastle.jcajce.provider.X509CertificateObject.verify(Unknown Source)
        at javax.crypto.JarVerifier.testSignatures(JarVerifier.java:773)
        at javax.crypto.JarVerifier.access$400(JarVerifier.java:37)
        at javax.crypto.JarVerifier$1.run(JarVerifier.java:222)
        at javax.crypto.JarVerifier$1.run(JarVerifier.java:187)
        ... 10 more

---------- BEGIN SOURCE ----------
Java code that demonstrates this is simple:

import javax.crypto.Mac;

public class BCDemo {
public static void main(String[] args) {
try {
Mac.getInstance("HmacSHA256");
}
catch (Throwable t) {
t.printStackTrace();
}
}
}

However, the JRE must be configured such that the BouncyCastle provider is available and running in "approved only" mode. This requires installing the BC FIPS jar and running with a security manager.

In my environment, the security providers (java.security) are as follows:

security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
security.provider.2=com.sun.net.ssl.internal.ssl.Provider BCFIPS
security.provider.3=sun.security.provider.Sun

The policy file for the test is:
grant codeBase "file:///&lt;path-to-bc&gt;/bc-fips-1.0.0.jar" {
  permission java.security.SecurityPermission "putProviderProperty.BCFIPS";
  permission java.lang.RuntimePermission "getProtectionDomain";
  permission java.lang.RuntimePermission "accessDeclaredMembers";
  permission java.lang.RuntimePermission "accessClassInPackage.sun.security.internal.spec";
  permission java.lang.RuntimePermission "accessClassInPackage.sun.security.provider";
  permission org.bouncycastle.crypto.CryptoServicesPermission "exportKeys";
};

I added the current dir and bc-fips-1.0.0.jar to the CLASSPATH environment variable and ran the java command as follows:

java -Djava.security.manager -Djava.security.policy=<path>/bc.policy BCDemo

---------- END SOURCE ----------

CUSTOMER SUBMITTED WORKAROUND :
There is no workaround.