FIPS user claims

[Raghu Chidambaram]

HI Team,

we are using OpenSSL 3.5.x version and FIPS provider 3.0.9 and making it as FIPS compliant by using the right algorithms.

we have till now claimed the FIPS compliant to our products, wanted to understand one thing as FIPS 140-2 certificate got expired on Sep 21 2026 .
we had released one recent release on Sep 30th, so can still claim we are  FIPS compliant and not FIPS certified ?

We are not tied upto any certificate, because we are FIPS compliance by user affirmation from our security advisors.

we have a release and the work for FIPS 140-3 is in progress which may get completed by Dec 2026 end. 

Need your inputs on this please

Thanks,
Raghavendra

[Kajal Sapkota]

Hi Raghavendra,

A few points that should clarify where things stand.

The FIPS provider 3.0.9 you are using is validated under FIPS 140-2 certificates #4282 and #4811. Those certificates reached their sunset date on September 21, 2026 and have moved to the CMVP Historical List. Historical status is not a revocation and the validation itself still exists. In practice it means US federal agencies should not include the module in new procurements, while already deployed systems can generally continue to operate it at the discretion of the relevant authorizing official.

That is the lens to apply to your September 30 release. A compliance claim by user affirmation is anchored to the underlying certificate, and for anything shipped after September 21 that certificate is now historical. Whether "compliant but not certified" wording is acceptable for your products is a determination for your customers and auditors against their specific procurement requirements, not something we can rule on for you. The wording itself does not change the certificate status they will check.

There is a cleaner path available now rather than waiting for December. The OpenSSL FIPS provider 3.1.2 is validated under FIPS 140-3 certificate #4985, active to March 2030, and it can be used with OpenSSL 3.5.x since the provider is validated independently of the library version. Moving from the 3.0.9 provider to 3.1.2 would put your releases back on an active certificate. For planning further out, the 3.5.4 provider has been submitted for FIPS 140-3 validation and is in CMVP review.

If it would be useful to talk through the migration, let me know.

Best Regards,

Kajal Sapkota
Business Development Manager | Commercial Lead

ka...@openssl.org

001-302-722-0037
 

OpenSSL Software Services Inc.
40 E Main St, Suite 744 · Newark DE 19711 USA

www.openssl.org

--
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-user...@openssl.org.
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/6207170d-dad0-4c46-8c56-fa7bf5f0c2f2n%40openssl.org.

[Raghu Chidambaram]

Thanks Sapkota for the detailed information,

We had discussion with our security advisors and released on Sep 30th as user affirmation (FIPs 140-2).

we are targeting to be FIPS 140-3 compliant in the upcoming release in Dec 15th so that we can take OpenSSL 3.5.x and FIPS provider 3.1.2 and make changes if required in the code to make it 140-2 compliant.

==

For planning further out, the 3.5.4 provider has been submitted for FIPS 140-3 validation and is in CMVP review.

- is this related to the FIPS provider version 3.5.4? as you mentioned FIPS provider 3.1.2 is already 140-3 certified right? then again for 3.5.4 provider as well 140-3 is being taken?

sorry i might have missed something here

Thanks,

Raghavendra