Sun Microsystems GlassFish Enterprise Server 2.1 Administration Manual page 136

Configuring the Enterprise Server for Message Security
If you are running the Enterprise Server on version 1.5 of the Java SDK, the JCE provider is
already configured properly. If you are running the Enterprise Server on version 1.4.x of the
Java SDK, you can add a JCE provider statically as part of your JDK environment, as follows.
1. Download and install a JCE provider JAR (Java ARchive) file.
2. Copy the JCE provider JAR file to java-home/jre/lib/ext/.
3. Stop the Enterprise Server.
4. Edit the java-home/jre/lib/security/java.security properties file in any text editor.
5. Save and close the file.
136 Sun GlassFish Enterprise Server 2.1 Administration Guide • December 2008
The following URL provides a list of JCE providers that support RSA encryption:
http://java.sun.com/products/jce/javase_providers.html.
If the Enterprise Server is not stopped and then restarted later in this process, the JCE
provider will not be recognized by the Enterprise Server.
Add the JCE provider you've just downloaded to this file.
The java.security file contains detailed instructions for adding this provider. Basically,
you need to add a line of the following format in a location with similar properties:
security.provider.n=provider-class-name
In this example, n is the order of preference to be used by the Enterprise Server when
evaluating security providers. Set n to 2 for the JCE provider you've just added.
For example, if you've downloaded The Legion of the Bouncy Castle JCE provider, you
would add this line.
security.provider.2=org.bouncycastle.jce.provider.
BouncyCastleProvider
Make sure that the Sun security provider remains at the highest preference, with a value of 1.
security.provider.1=sun.security.provider.Sun
Adjust the levels of the other security providers downward so that there is only one security
provider at each level.
The following is an example of a java.security file that provides the necessary JCE
provider and keeps the existing providers in the correct locations.
security.provider.1=sun.security.provider.Sun
security.provider.2=org.bouncycastle.jce.provider.
BouncyCastleProvider
security.provider.3=com.sun.net.ssl.internal.ssl.Provider
security.provider.4=com.sun.rsajca.Provider
security.provider.5=com.sun.crypto.provider.SunJCE
security.provider.6=sun.security.jgss.SunProvider