@VisibleForTesting
  static void validateFips(final KsqlConfig config, final KsqlRestConfig restConfig) {
    if (config.getBoolean(ConfluentConfigs.ENABLE_FIPS_CONFIG)) {
      final FipsValidator fipsValidator = ConfluentConfigs.buildFipsValidator();

      // validate cipher suites and TLS version
      validateCipherSuites(fipsValidator, restConfig);

      // validate broker
      validateBroker(fipsValidator, config);

      // validate ssl endpoint algorithm
      validateSslEndpointAlgo(fipsValidator, restConfig);

      // validate schema registry url
      validateSrUrl(fipsValidator, restConfig);

      // validate all listeners
      validateListeners(fipsValidator, restConfig);

      log.info("FIPS mode enabled for ksqlDB!");
    }
  }
@Test
  public void shouldFailOnInvalidProxyListenerProtocols() {
    // Given:
    final KsqlConfig config = configWith(ImmutableMap.of(
        ConfluentConfigs.ENABLE_FIPS_CONFIG, true,
        CommonClientConfigs.SECURITY_PROTOCOL_CONFIG, SecurityProtocol.SASL_SSL.name
    ));
    final KsqlRestConfig restConfig = new KsqlRestConfig(ImmutableMap.<String, Object>builder()
        .put(KsqlRestConfig.SSL_CIPHER_SUITES_CONFIG,
            Collections.singletonList("TLS_RSA_WITH_AES_256_CCM"))
        .put(KsqlConfig.SSL_ENDPOINT_IDENTIFICATION_ALGORITHM_CONFIG, "https")
        .put(KsqlRestConfig.LISTENERS_CONFIG,
            Collections.singletonList("https://bar:8080"))
        .put(KsqlRestConfig.PROXY_PROTOCOL_LISTENERS_CONFIG,
            Collections.singletonList("http://baz:8080"))
        .build()
    );


    // When:
    final Exception e = assertThrows(
        SecurityException.class,
        () -> KsqlServerMain.validateFips(config, restConfig)
    );

    // Then:
    assertThat(e.getMessage(), containsString(
        "FIPS 140-2 Configuration Error, invalid rest protocol: http"
            + "\nInvalid rest protocol for listeners."
            + "\nMake sure that all listeners, listeners.proxy.protocol, ksql.advertised.listener, and ksql.internal.listener follow FIPS 140-2."));
  }