Skip to content

Working with Distributed Issuer and FIPS

Distributed Issuer images are available in both standard and FIPS formats.

  • Use standard (non-FIPS) images if performance is a key factor for you, or you need access to newer cryptographic algorithms. If you don't have regulatory compliance needs, a standard image may be the better choice.
  • Using FIPS images allows companies to meet regulatory compliance, particularly for government agencies or contractors, as well as finance and health sectors, and ensures that data is protected with robust, validated encryption and security measures. FIPS mode also provides robust data security ensuring that data, both at rest and in transit, is protected.

Federal Information Processing Standards (FIPS) mode makes Distributed Issuer use the system's cryptographic libraries. In the Distributed Issuer FIPS container images, these cryptographic libraries are FIPS 140-2 validated.

Important

Not all cryptographic algorithms are FIPS-validated. Distributed Issuer automatically disables non-FIPS algorithms for TLS-served API endpoints, including REST and gRPC. Algorithms permitted for certificate issuance are configured in the control plane. To ensure Distributed Issuer uses only approved algorithms, enforce your corporate security policies to restrict non-compliant key types and signing algorithms.

Important

The FIPS cryptographic libraries included in our Distributed Issuer FIPS container images require your underlying platform to operate FIPS mode. When running on Kubernetes and OpenShift, this means that all worker nodes must run in FIPS mode too. For more information, see Running Kubernetes and OpenShift in FIPS mode.

For information on FIPS mode on the major cloud platforms, see Running Kubernetes and OpenShift in FIPS mode.

Running Kubernetes and OpenShift in FIPS mode

Confirming Kubernetes and OpenShift are running in FIPS mode

For each of the nodes in your cluster, you can confirm it is running in FIPS mode by checking the Node Kernel FIPS Flag:

kubectl debug -it node/<node_name> --image=ubuntu -- chroot /host cat /proc/sys/crypto/fips_enabled

Expected output:

1

Enforcing FIPS mode on Distributed Issuer instances

To ensure that all Distributed Issuer instances run in FIPS mode in Next-Gen Trust Security:

  1. Sign into Next-Gen Trust Security.
  2. Click Configurations > Issuer Configurations and select an issuer configuration.
  3. In the side panel, select Require Issuer instances to be FIPS compliant.