How to run a fully FIPS compliant in Spring Boot application

$ sudo apt install libapr1 libapr1-dev (from here, might be sudo apt install libapr1-dev libssl-dev though, see here)

Download tomcat-native-1.2.23-src from here, extract, go to tomcat-native-1.2.23-src/native/

$ ./configure --with-apr=/usr/bin/apr-1-config --with-java-home=/path/to/java-home/ --with-ssl=yes

$ make

Add -Djava.library.path=/path/to/tomcat-native-1.2.23-src/native/.libs to jvm args

import org.apache.catalina.core.AprLifecycleListener;
import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory;
import org.springframework.boot.web.server.Ssl;
import org.springframework.boot.web.servlet.server.ServletWebServerFactory;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class AprConfig {

  @Bean
  public ServletWebServerFactory servletContainer() {
    TomcatServletWebServerFactory factory = new TomcatServletWebServerFactory() {
      @Override
      public Ssl getSsl() {
        // avoid "IllegalStateException: To use SSL, the connector's protocol handler must be an AbstractHttp11JsseProtocol subclass":
        return null;
      }
    };

    // enable APR:
    factory.setProtocol("org.apache.coyote.http11.Http11AprProtocol");

    AprLifecycleListener aprLifecycleListener = new AprLifecycleListener();

    // will throw "FIPS was not available to tcnative at build time. You will need to re-build tcnative against an OpenSSL with FIPS." with default OpenSSL:
    aprLifecycleListener.setFIPSMode("on");

    factory.addContextLifecycleListeners(aprLifecycleListener);
    return factory;
  }
}