Skip to content

Working with Workload Identity Manager and FIPS

Workload Identity Manager images are available in both standard and FIPS formats.

  • Use standard (non-FIPS) images if performance is a key factor for you, or you need access to newer cryptographic algorithms. If you don't have regulatory compliance needs, a standard image may be the better choice.
  • Using FIPS images allows companies to meet regulatory compliance, particularly for government agencies or contractors, as well as finance and health sectors, and ensures that data is protected with robust, validated encryption and security measures. FIPS mode also provides robust data security ensuring that data, both at rest and in transit, is protected.

The Workload Identity Manager FIPS container images embed the Go Cryptographic Module (certificate #5247), which is FIPS 140-3 validated. The module is compiled into each binary, so FIPS compliance doesn't depend on the host or the underlying platform.

Important

Not all cryptographic algorithms are FIPS-validated. Workload Identity Manager automatically disables non-FIPS algorithms for TLS-served API endpoints, including REST and gRPC. Algorithms permitted for certificate issuance are configured in the control plane. To ensure Workload Identity Manager uses only approved algorithms, enforce your corporate security policies to restrict non-compliant key types and signing algorithms.

For general information about FIPS compliance across Palo Alto Networks components, including how to confirm a FIPS build and which cryptographic module each version uses, see FIPS compliance.

Enforcing FIPS mode on Workload Identity Manager instances

You can enforce FIPS mode for your Workload Identity Manager instances on both Certificate Manager - SaaS and Certificate Manager - Self-Hosted.

Enforcing FIPS mode in Certificate Manager - SaaS

To ensure that all Workload Identity Manager instances run in FIPS mode in Certificate Manager - SaaS:

  1. Sign into Certificate Manager - SaaS.
  2. Click Configurations>Issuer Configurations, and select the issuer configuration you want to update.

  3. In the side panel that opens, select the Require Issuer instances to be FIPS compliant checkbox.

    Tip

    You can also set this parameter when you create a new configuration. For more information, see Workload Identity Manager configurations.

Enforcing FIPS mode in Certificate Manager - Self-Hosted

To ensure that Workload Identity Manager instances run in FIPS mode in Certificate Manager - Self-Hosted, set the following parameter in your Workload Identity Manager configuration file:

...
advancedSettings:
  requireFIPSCompliantBuild: true