BTW, FIPS tests pass with (only showing JDK 21 below):

@@ -144,7 +144,7 @@
                                                                    :minor minor})]
                                       (condp = (java.lang.Integer/parseInt major)
                                         17 ["-Djava.security.properties==dev-resources/jdk17-fips-security"]
-                                        21 ["-Djava.security.properties==dev-resources/jdk21-fips-security"]
+                                        21 ["-Djava.security.properties==dev-resources/jdk21-fips-security" "-Dorg.bouncycastle.jsse.hostname_check_cn_fallback=true"]
                                         25 ["-Djava.security.properties==dev-resources/jdk25-fips-security"]
                                         (throw unsupported-ex)))}
              :fips [:shared :fips-only]