Upgrading from a FIPS-enabled environment

To ensure FIPS compliance, all IBM® Workload Scheduler components must meet the following requirements:

All components must be at version 10.2.5 or later.
The certificates must employ at least a robust 2K RSA key and use encryption algorithms different from MD5-RSA and SHA1-RSA.
The key must be in a format where the algorithms are supported by FIPS. For example, avoid the PKCS1 format with the MD5 algorithm or the PKCS8 format with the 3DES algorithm.

FIPS is supported on all supported operating systems with the exception of IBM i operating systems.

When upgrading from an environment where FIPS is enabled, you can encounter one of the following situations:

If certificates do not meet FIPS standards: An error message is displayed stating that the current security configuration does not support FIPS mode and the upgrade stops. To enable FIPS in full mode, proceed to step 1.
If certificates meet FIPS standards: You can upgrade and maintain FIPS enabled. Proceed to step 2.

To make your environment FIPS compliant, perform the procedure described below on all components in your environment.

If your current certificates do not meet FIPS standards, replace them with CA-signed certificates, as explained in Replacing Default SSL Certificates with CA signed Customer Certificates.
On the master domain manager, start the upgrade procedure, as described in Upgrading from the CLI. IBM Workload Scheduler discovers that FIPS is enabled in the source environment and proceeds with enabling it in the target environment.
The upgrade completes, enabling FIPS in weak mode. When in weak mode, the upgraded master domain manager can communicate with back-level components, ensuring business continuity.
On the master domain manager, run the following command to set the environment variables:
```
. ./tws_env.sh
```
On the master domain manager, run the following command to verify the security status:
```
secure -checksecurity
```
A message similar to the following is displayed:
```
FIPS configuration updated in weak mode. To enable full FIPS mode, 
update the master domain manager and all backup master domain managers to the 
current release. Then, run the secure -updatesecurity command on master domain manager.
```
As stated in the message, before you set up FIPS in full mode on the master domain manager, it is necessary to upgrade all components in your environment to version 10.2.5 or later.
Upgrade the remaining server components (backup master domain manager, dynamic domain manager, backup dynamic domain manager) if any, as described in Upgrading from the CLI.
Upgrade the Dynamic Workload Console.
Upgrade the agents.
On the master domain manager, run the following command to check the encryption level of user passwords in the database and change it from 3DES to AES, if necessary:
```
secure -updatesecurity
```
This command also sets the useAESEncryptionAlgorithm optman option to yes For more information about global options, see Global options - detailed description.
On the master domain manager and backup master domain manager, run the following command to set FIPS in full mode:
```
secure -fips on
```
The master domain manager switches to full FIPS mode after IBM Workload Scheduler processes are restarted. For more information about the secure command, see Optional password encryption - secure script.
Restart the master domain manager and backup master domain manager to make the switch to full FIPS mode effective. To avoid service interruptions, use the following command:
```
switchmgr domain;newmgr
```
For more information, see Switching a domain manager.
On the Dynamic Workload Console, run the following command to set the environment variables:
```
. ./dwc_env.sh
```
On the Dynamic Workload Console, run the following command to set FIPS in full mode:
```
secure -fips on
```
On each agent, run the following command to set the environment variables:
```
. ./tws_env.sh
```
On each agent, run the following command to set FIPS in full mode:
```
secure -fips on
```
Restart all IBM Workload Scheduler processes on the Dynamic Workload Console and agents to make changes to FIPS configuration effective. To prevent communication problems after switching to full FIPS mode, ensure you perform a coordinated restart of the various components.

FIPS is now correctly enabled in full mode in your environment.