[JENKINS-74907] Plugin allows non compliant keys, disabling SSL and allowing self signed certificate in FIPS mode

When configuring a Windows AMI, the plugin allows:

• self signed certificate


• disabling TLS while using a password

We should inform the user in a `FormValidation` that those fields can not be enabled when running in FIPS mode and don't allow saving them.

We should also validate that the host key and the private key use FIPS compliant key size.

---
Originally reported by jmdesprez, imported from: Plugin allows non compliant keys, disabling SSL and allowing self signed certificate in FIPS mode

• assignee: jmdesprez
  
• status: Open
  
• priority: Minor
  
• component(s): ec2-plugin
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 1
  
• imported: 2025-12-06
  

When configuring a Windows AMI, the plugin allows:



	
self signed certificate

	
disabling TLS while using a password



We should inform the user in a `FormValidation` that those fields can not be enabled when running in FIPS mode and don't allow saving them.


 


We should also validate that the host key and the private key use FIPS compliant key size.

Start at the Windows AMI configuration handling in the ec2-plugin and trace the FormValidation entry points for the certificate, TLS, host-key, and private-key fields. Done means FIPS-mode validation reports invalid settings and prevents saving non-compliant configurations, including keys with non-compliant sizes.

Written by the indexing model from the issue text.