diff --git openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java

index f9baf8c9742..60fa75cab45 100644

--- openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java

+++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java

@@ -1,11 +1,13 @@

 /*

- * Copyright (c) 2019, Red Hat, Inc.

+ * Copyright (c) 2019, 2020, Red Hat, Inc.

  *

  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

  *

  * This code is free software; you can redistribute it and/or modify it

  * under the terms of the GNU General Public License version 2 only, as

- * published by the Free Software Foundation.

+ * published by the Free Software Foundation.  Oracle designates this

+ * particular file as subject to the "Classpath" exception as provided

+ * by Oracle in the LICENSE file that accompanied this code.

  *

  * This code is distributed in the hope that it will be useful, but WITHOUT

  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

@@ -34,10 +36,10 @@ import java.nio.file.Path;

 import java.util.Iterator;

 import java.util.Map.Entry;

 import java.util.Properties;

-import java.util.function.Consumer;

-import java.util.regex.Matcher;

 import java.util.regex.Pattern;

+import jdk.internal.access.JavaSecuritySystemConfiguratorAccess;

+import jdk.internal.access.SharedSecrets;

 import sun.security.util.Debug;

 /**

@@ -47,7 +49,7 @@ import sun.security.util.Debug;

  *

  */

-class SystemConfigurator {

+final class SystemConfigurator {

     private static final Debug sdebug =

             Debug.getInstance("properties");

@@ -61,15 +63,16 @@ class SystemConfigurator {

     private static final String CRYPTO_POLICIES_CONFIG =

             CRYPTO_POLICIES_BASE_DIR + "/config";

-    private static final class SecurityProviderInfo {

-        int number;

-        String key;

-        String value;

-        SecurityProviderInfo(int number, String key, String value) {

-            this.number = number;

-            this.key = key;

-            this.value = value;

-        }

+    private static boolean systemFipsEnabled = false;

+

+    static {

+        SharedSecrets.setJavaSecuritySystemConfiguratorAccess(

+            new JavaSecuritySystemConfiguratorAccess() {

+                @Override

+                public boolean isSystemFipsEnabled() {

+                    return SystemConfigurator.isSystemFipsEnabled();

+                }

+            });

     }

     /*

@@ -128,9 +131,9 @@ class SystemConfigurator {

                     String nonFipsKeystoreType = props.getProperty("keystore.type");

                     props.put("keystore.type", keystoreTypeValue);

                     if (keystoreTypeValue.equals("PKCS11")) {

-                    	// If keystore.type is PKCS11, javax.net.ssl.keyStore

-                    	// must be "NONE". See JDK-8238264.

-                    	System.setProperty("javax.net.ssl.keyStore", "NONE");

+                        // If keystore.type is PKCS11, javax.net.ssl.keyStore

+                        // must be "NONE". See JDK-8238264.

+                        System.setProperty("javax.net.ssl.keyStore", "NONE");

                     }

                     if (System.getProperty("javax.net.ssl.trustStoreType") == null) {

                         // If no trustStoreType has been set, use the

@@ -144,12 +147,13 @@ class SystemConfigurator {

                         sdebug.println("FIPS mode default keystore.type = " +

                                 keystoreTypeValue);

                         sdebug.println("FIPS mode javax.net.ssl.keyStore = " +

-                        		System.getProperty("javax.net.ssl.keyStore", ""));

+                                System.getProperty("javax.net.ssl.keyStore", ""));

                         sdebug.println("FIPS mode javax.net.ssl.trustStoreType = " +

                                 System.getProperty("javax.net.ssl.trustStoreType", ""));

                     }

                 }

                 loadedProps = true;

+                systemFipsEnabled = true;

             }

         } catch (Exception e) {

             if (sdebug != null) {

@@ -160,13 +164,30 @@ class SystemConfigurator {

         return loadedProps;

     }

+    /**

+     * Returns whether or not global system FIPS alignment is enabled.

+     *

+     * Value is always 'false' before java.security.Security class is

+     * initialized.

+     *

+     * Call from out of this package through SharedSecrets:

+     *   SharedSecrets.getJavaSecuritySystemConfiguratorAccess()

+     *           .isSystemFipsEnabled();

+     *

+     * @return  a boolean value indicating whether or not global

+     *          system FIPS alignment is enabled.

+     */

+    static boolean isSystemFipsEnabled() {

+        return systemFipsEnabled;

+    }

+

     /*

      * FIPS is enabled only if crypto-policies are set to "FIPS"

      * and the com.redhat.fips property is true.

      */

     private static boolean enableFips() throws Exception {

-        boolean fipsEnabled = Boolean.valueOf(System.getProperty("com.redhat.fips", "true"));

-        if (fipsEnabled) {

+        boolean shouldEnable = Boolean.valueOf(System.getProperty("com.redhat.fips", "true"));

+        if (shouldEnable) {

             String cryptoPoliciesConfig = new String(Files.readAllBytes(Path.of(CRYPTO_POLICIES_CONFIG)));

             if (sdebug != null) { sdebug.println("Crypto config:\n" + cryptoPoliciesConfig); }

             Pattern pattern = Pattern.compile("^FIPS$", Pattern.MULTILINE);

diff --git openjdk/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java openjdk/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java

new file mode 100644

index 00000000000..a31e93ec02e

--- /dev/null

+++ openjdk/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java

@@ -0,0 +1,30 @@

+/*

+ * Copyright (c) 2020, Red Hat, Inc.

+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

+ *

+ * This code is free software; you can redistribute it and/or modify it

+ * under the terms of the GNU General Public License version 2 only, as

+ * published by the Free Software Foundation.  Oracle designates this

+ * particular file as subject to the "Classpath" exception as provided

+ * by Oracle in the LICENSE file that accompanied this code.

+ *

+ * This code is distributed in the hope that it will be useful, but WITHOUT

+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

+ * version 2 for more details (a copy is included in the LICENSE file that

+ * accompanied this code).

+ *

+ * You should have received a copy of the GNU General Public License version

+ * 2 along with this work; if not, write to the Free Software Foundation,

+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

+ *

+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

+ * or visit www.oracle.com if you need additional information or have any

+ * questions.

+ */

+

+package jdk.internal.access;

+

+public interface JavaSecuritySystemConfiguratorAccess {

+    boolean isSystemFipsEnabled();

+}

diff --git openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java

index f6d3638c3dd..5a2c9eb0c46 100644

--- openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java

+++ openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java

@@ -81,6 +81,7 @@ public class SharedSecrets {

     private static JavaSecuritySpecAccess javaSecuritySpecAccess;

     private static JavaxCryptoSealedObjectAccess javaxCryptoSealedObjectAccess;

     private static JavaxCryptoSpecAccess javaxCryptoSpecAccess;

+    private static JavaSecuritySystemConfiguratorAccess javaSecuritySystemConfiguratorAccess;

     public static void setJavaUtilCollectionAccess(JavaUtilCollectionAccess juca) {

         javaUtilCollectionAccess = juca;

@@ -442,4 +443,12 @@ public class SharedSecrets {

             MethodHandles.lookup().ensureInitialized(c);

         } catch (IllegalAccessException e) {}

     }

+

+    public static void setJavaSecuritySystemConfiguratorAccess(JavaSecuritySystemConfiguratorAccess jssca) {

+        javaSecuritySystemConfiguratorAccess = jssca;

+    }

+

+    public static JavaSecuritySystemConfiguratorAccess getJavaSecuritySystemConfiguratorAccess() {

+        return javaSecuritySystemConfiguratorAccess;

+    }

 }

diff --git openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java

index 6ffdfeda18d..775b185fb06 100644

--- openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java

+++ openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java

@@ -32,6 +32,7 @@ import java.security.cert.*;

 import java.util.*;

 import java.util.concurrent.locks.ReentrantLock;

 import javax.net.ssl.*;

+import jdk.internal.access.SharedSecrets;

 import sun.security.action.GetPropertyAction;

 import sun.security.provider.certpath.AlgorithmChecker;

 import sun.security.validator.Validator;

@@ -536,22 +537,40 @@ public abstract class SSLContextImpl extends SSLContextSpi {

         private static final List<CipherSuite> serverDefaultCipherSuites;

         static {

-            supportedProtocols = Arrays.asList(

-                ProtocolVersion.TLS13,

-                ProtocolVersion.TLS12,

-                ProtocolVersion.TLS11,

-                ProtocolVersion.TLS10,

-                ProtocolVersion.SSL30,

-                ProtocolVersion.SSL20Hello

-            );

-

-            serverDefaultProtocols = getAvailableProtocols(

-                    new ProtocolVersion[] {

-                ProtocolVersion.TLS13,

-                ProtocolVersion.TLS12,

-                ProtocolVersion.TLS11,

-                ProtocolVersion.TLS10

-            });

+            if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()

+                    .isSystemFipsEnabled()) {

+                // RH1860986: TLSv1.3 key derivation not supported with

+                // the Security Providers available in system FIPS mode.

+                supportedProtocols = Arrays.asList(

+                    ProtocolVersion.TLS12,

+                    ProtocolVersion.TLS11,

+                    ProtocolVersion.TLS10

+                );

+

+                serverDefaultProtocols = getAvailableProtocols(

+                        new ProtocolVersion[] {

+                    ProtocolVersion.TLS12,

+                    ProtocolVersion.TLS11,

+                    ProtocolVersion.TLS10

+                });

+            } else {

+                supportedProtocols = Arrays.asList(

+                    ProtocolVersion.TLS13,

+                    ProtocolVersion.TLS12,

+                    ProtocolVersion.TLS11,

+                    ProtocolVersion.TLS10,

+                    ProtocolVersion.SSL30,

+                    ProtocolVersion.SSL20Hello

+                );

+

+                serverDefaultProtocols = getAvailableProtocols(

+                        new ProtocolVersion[] {

+                    ProtocolVersion.TLS13,

+                    ProtocolVersion.TLS12,

+                    ProtocolVersion.TLS11,

+                    ProtocolVersion.TLS10

+                });

+            }

             supportedCipherSuites = getApplicableSupportedCipherSuites(

                     supportedProtocols);

@@ -842,12 +861,23 @@ public abstract class SSLContextImpl extends SSLContextSpi {

             ProtocolVersion[] candidates;

             if (refactored.isEmpty()) {

                 // Client and server use the same default protocols.

-                candidates = new ProtocolVersion[] {

-                        ProtocolVersion.TLS13,

-                        ProtocolVersion.TLS12,

-                        ProtocolVersion.TLS11,

-                        ProtocolVersion.TLS10

-                    };

+                if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()

+                        .isSystemFipsEnabled()) {

+                    // RH1860986: TLSv1.3 key derivation not supported with

+                    // the Security Providers available in system FIPS mode.

+                    candidates = new ProtocolVersion[] {

+                            ProtocolVersion.TLS12,

+                            ProtocolVersion.TLS11,

+                            ProtocolVersion.TLS10

+                        };

+                } else {

+                    candidates = new ProtocolVersion[] {

+                            ProtocolVersion.TLS13,

+                            ProtocolVersion.TLS12,

+                            ProtocolVersion.TLS11,

+                            ProtocolVersion.TLS10

+                        };

+                }

             } else {

                 // Use the customized TLS protocols.

                 candidates =

diff --git openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java

index 894e26dfad8..8b16378b96b 100644

--- openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java

+++ openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java

@@ -27,6 +27,8 @@ package sun.security.ssl;

 import java.security.*;

 import java.util.*;

+

+import jdk.internal.access.SharedSecrets;

 import static sun.security.util.SecurityConstants.PROVIDER_VER;

 /**

@@ -102,8 +104,13 @@ public class SunJSSE extends java.security.Provider {

             "sun.security.ssl.SSLContextImpl$TLS11Context", null, null);

         ps("SSLContext", "TLSv1.2",

             "sun.security.ssl.SSLContextImpl$TLS12Context", null, null);

-        ps("SSLContext", "TLSv1.3",

-            "sun.security.ssl.SSLContextImpl$TLS13Context", null, null);

+        if (!SharedSecrets.getJavaSecuritySystemConfiguratorAccess()

+                .isSystemFipsEnabled()) {

+            // RH1860986: TLSv1.3 key derivation not supported with

+            // the Security Providers available in system FIPS mode.

+            ps("SSLContext", "TLSv1.3",

+                "sun.security.ssl.SSLContextImpl$TLS13Context", null, null);

+        }

         ps("SSLContext", "TLS",

             "sun.security.ssl.SSLContextImpl$TLSContext",

             List.of("SSL"), null);