diff -r 6efbd7b35a10 src/share/classes/java/security/SystemConfigurator.java

--- openjdk.orig/jdk/src/share/classes/java/security/SystemConfigurator.java	Thu Jan 23 18:22:31 2020 -0300

+++ openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java	Mon Mar 02 19:20:17 2020 -0300

@@ -123,6 +123,33 @@

                     }

                     props.put(fipsProviderKey, fipsProviderValue);

                 }

+                // Add other security properties

+                String keystoreTypeValue = (String) props.get("fips.keystore.type");

+                if (keystoreTypeValue != null) {

+                    String nonFipsKeystoreType = props.getProperty("keystore.type");

+                    props.put("keystore.type", keystoreTypeValue);

+                    if (keystoreTypeValue.equals("PKCS11")) {

+                    	// If keystore.type is PKCS11, javax.net.ssl.keyStore

+                    	// must be "NONE". See JDK-8238264.

+                    	System.setProperty("javax.net.ssl.keyStore", "NONE");

+                    }

+                    if (System.getProperty("javax.net.ssl.trustStoreType") == null) {

+                        // If no trustStoreType has been set, use the

+                        // previous keystore.type under FIPS mode. In

+                        // a default configuration, the Trust Store will

+                        // be 'cacerts' (JKS type).

+                        System.setProperty("javax.net.ssl.trustStoreType",

+                                nonFipsKeystoreType);

+                    }

+                    if (sdebug != null) {

+                        sdebug.println("FIPS mode default keystore.type = " +

+                                keystoreTypeValue);

+                        sdebug.println("FIPS mode javax.net.ssl.keyStore = " +

+                        		System.getProperty("javax.net.ssl.keyStore", ""));

+                        sdebug.println("FIPS mode javax.net.ssl.trustStoreType = " +

+                                System.getProperty("javax.net.ssl.trustStoreType", ""));

+                    }

+                }

                 loadedProps = true;

             }

         } catch (Exception e) {

diff -r 6efbd7b35a10 src/share/lib/security/java.security-linux

--- openjdk.orig/jdk/src/share/lib/security/java.security-linux	Thu Jan 23 18:22:31 2020 -0300

+++ openjdk/jdk/src/share/lib/security/java.security-linux	Mon Mar 02 19:20:17 2020 -0300

@@ -179,6 +179,11 @@

 keystore.type=jks

 #

+# Default keystore type used when global crypto-policies are set to FIPS.

+#

+fips.keystore.type=PKCS11

+

+#

 # Controls compatibility mode for the JKS keystore type.

 #

 # When set to 'true', the JKS keystore type supports loading