What does it mean when we talk about FIPS-197 compliance in the context of SSL certificates, their deployment and usage ?
I am almost certain that the FIPS-197 compliance in the context of SSL configuration is not about how the certificate is generated and signed but rather about how the web server / application server(Eg: Jetty / Apache / Nginx / JBOSS etc) are configured. By configured, I mean to say - the SSL / TLS version that is being used and specifically the CipherSuites that are in the allowed list and their order.
This document has the recommended CipherSuites. My understanding says that if we ensure that the client and Server negotiate a CipherSuite that uses AES for confidentiality (Eg: TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA) then SSL configuration is FIPS-197 compliant. Is my understanding correct ?
OR Is there anything required during the certificate generation process as well to ensure compliance with FIPS-197.
I am kind of confident about my understanding but just want to be sure.