---
title: FIPS mode for Ingest tools
description: Elastic Agent, Fleet, Filebeat, Metricbeat, and APM Server binaries are built and configured to use FIPS-140-compliant cryptography: stack: preview 9.1-9.2...
url: https://www.elastic.co/elastic/docs-builder/docs/3895/deploy-manage/security/fips-ingest
products:
  - APM
  - Beats
  - Elastic Agent
  - Fleet
applies_to:
  - Elastic Stack: Generally available since 9.3, Preview from 9.1 to 9.2
---

# FIPS mode for Ingest tools
Elastic Agent, Fleet, Filebeat, Metricbeat, and APM Server binaries are built and configured to use FIPS-140-compliant cryptography:
- <applies-to>Elastic Stack: Preview from 9.1 to 9.2</applies-to> FIPS binaries use FIPS 140-2 compliant cryptography.
- <applies-to>Elastic Stack: Generally available since 9.3</applies-to> Filebeat, Metricbeat, and APM Server FIPS binaries use FIPS 140-3 compliant cryptography using Go's native FIPS 140-3 module (`GOFIPS140=v1.0.0`, CMVP Certificate [#5247](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5247)).
- <applies-to>Elastic Stack: Generally available since 9.5</applies-to> Elastic Agent and Fleet Server FIPS binaries use the same FIPS 140-3 module. On 9.3 and 9.4, Elastic Agent and Fleet Server FIPS binaries continue to use FIPS 140-2 cryptography.

Specific components and configurations that fall outside the certified boundary are documented in the [Limitations](#ingest-limitations-all) section.

## FIPS-compatible binaries and configuration

FIPS compatible binaries for Elastic Agent, Fleet, Filebeat, Metricbeat, and APM Server are available for [download](https://www.elastic.co/downloads). Look for the `Linux 64-bit (FIPS)` or `Linux aarch64 (FIPS)` platform option on the product download pages for Elastic Agent and Fleet, Filebeat, and Metricbeat. Look for the `Linux x86_64 (FIPS)` or `Linux aarch64 (FIPS)` platform option on the APM Server download page.
<important>
  The default configurations provided in the binaries are FIPS compatible. Be sure to check and understand the implications of changing default configurations.
</important>


## Limitations


### TLS

Only FIPS-compliant TLS protocols, ciphers, and curve types are allowed, as defined by [CMVP Certificate #5247](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5247):
- The supported TLS versions are `TLS v1.2` and `TLS v1.3`.
- The supported cipher suites are:
  - `TLS v1.2`: `ECDHE-RSA-AES-128-GCM-SHA256`, `ECDHE-RSA-AES-256-GCM-SHA384`, `ECDHE-ECDSA-AES-128-GCM-SHA256`, `ECDHE-ECDSA-AES-256-GCM-SHA384`
- `TLS v1.3`: `TLS-AES-128-GCM-SHA256`, `TLS-AES-256-GCM-SHA384`
- The supported curve types are `P-256`, `P-384` and `P-521`.
- The minimum key length is 2048 bits for RSA keys. EC key size is determined by the curve in use.

Support for encrypted private keys is not available, as the cryptographic modules used for decrypting password protected keys are not FIPS validated. If an output or any other component with an SSL key that is password protected is configured, the components will fail to load the key. When running in FIPS mode, you must provide non-encrypted keys.
Be sure to enforce security in your FIPS environments through other means, such as strict file permissions and access controls on the key file itself, for example.
These TLS related restrictions apply to Elastic Agent, Fleet, Filebeat, Metricbeat, and APM Server.

### General output and input limitations (Kerberos protocol)

The Kerberos protocol is not supported for any output or input, which also impacts the available `sasl.mechanism` for the Kafka output where only `PLAIN` is supported.
This impacts [Filebeat](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/beats/filebeat/configuration-kerberos), [Metricbeat](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/beats/metricbeat/configuration-kerberos) and APM Server, as well as output configurations for Elastic Agent with Fleet Server.

### APM Server

- The [Secrets Keystore](https://www.elastic.co/elastic/docs-builder/docs/3895/solutions/observability/apm/apm-server/secrets-keystore-for-secure-settings) is not supported.


### Filebeat

- The [Secrets Keystore](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/beats/filebeat/keystore) is not supported.
- The [Translate GUID processor](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/beats/filebeat/processor-translate-guid) is not supported.
- The [Fingerprint processor](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/beats/filebeat/fingerprint) does not support the md5 and sha1 method.
- The [Community ID Network Flowhash processor](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/beats/filebeat/community-id) is not supported.
- The [Azure module](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/beats/filebeat/filebeat-module-azure) including the [Azure eventhub input](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/beats/filebeat/filebeat-input-azure-eventhub) and the [Azure Blob Storage Input](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-azure-blob-storage) are not supported. The [Add Cloud Metadata processor](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/beats/filebeat/add-cloud-metadata) does not support the Azure Virtual Machine provider.
- The [Office 365 module (Beta)](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/beats/filebeat/filebeat-module-o365) and the [Office 365 input (Deprecated)](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-o365audit) are not supported.
- The [GCP Pub/Sub input](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/beats/filebeat/filebeat-input-gcp-pubsub) and the [Google Cloud Storage input](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-gcs) are not supported.
- The [Entity Analytics input](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-entity-analytics) is not supported.


### Metricbeat

- The [Secrets Keystore](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/beats/metricbeat/keystore) is not supported.
- The [Translate GUID processor](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/beats/metricbeat/processor-translate-guid) is not supported.
- The [Fingerprint processor](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/beats/metricbeat/fingerprint) does not support the md5 and sha1 method.
- The [Community ID Network Flowhash processor](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/beats/metricbeat/community-id) is not supported.
- The [Azure module](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/beats/metricbeat/metricbeat-module-azure) is not supported. The [Add Cloud Metadata processor](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/beats/metricbeat/add-cloud-metadata) does not support the Azure Virtual Machine provider.
- The [Google Cloud Platform module](https://www.elastic.co/docs/reference/beats/metricbeat/metricbeat-module-gcp) is not supported.
- The [Beta KVM module](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/beats/metricbeat/metricbeat-module-kvm) is not supported.
- The [Mongo DB module](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/beats/metricbeat/metricbeat-module-mongodb) is not supported.
- The [MySQL](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/beats/metricbeat/metricbeat-module-mysql), [PostgreSQL](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/beats/metricbeat/metricbeat-module-postgresql), [MSSQL](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/beats/metricbeat/metricbeat-module-mssql) and [SQL](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/beats/metricbeat/metricbeat-module-sql) modules are not supported.
- The [Oracle module](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/beats/metricbeat/metricbeat-module-oracle) is not supported.


### Elastic Agent and Fleet Server

When you use Elastic Agent and Fleet Server, these limitations apply:
- Some Elastic Integrations are not FIPS compatible, as they depend on functionality that is not supported for FIPS configuration. In general, when using Elastic Agent and Fleet Server, the same restrictions listed previously for Metricbeat and Filebeat modules, inputs, and processors apply.
- <applies-to>Elastic Stack: Preview from 9.1 to 9.2</applies-to> Running Elastic Agent in [OpenTelemetry mode](https://github.com/elastic/elastic-agent/blob/main/internal/pkg/otel/README.md) is not supported in FIPS mode. This includes all receivers, such as Filebeat Receiver, Metricbeat Receiver, and [Prometheus Receiver](https://www.elastic.co/docs/reference/integrations/prometheus).
- Agent upgrade artifact verification uses GPG signature checking, which is outside the FIPS module boundary.


### Elastic Agent in OpenTelemetry mode (EDOT)

<applies-to>
  - Elastic Stack: Generally available since 9.3
</applies-to>

When running Elastic Agent in [OpenTelemetry mode](https://github.com/elastic/elastic-agent/blob/main/internal/pkg/otel/README.md) (EDOT), these additional limitations apply.
- **Azure integrations**: PKCS#12 (`.pfx`) client certificates are not supported for Azure Active Directory authentication. Use client secrets, workload identity, managed identity, or PEM-encoded certificate and key files instead.
- **Kafka metrics receiver**: SASL GSSAPI (Kerberos) is not supported. SASL SCRAM (SCRAM-SHA-256, SCRAM-SHA-512) is not FIPS-compliant. Use SASL/PLAIN over TLS or mTLS.
- The following components are not included in FIPS builds:
  - **Prometheus receiver**
- **Kafka receiver** and **Kafka exporter**
- The following receivers are not supported in FIPS mode:
  - **MongoDB receiver**
- **MySQL receiver**
- **Microsoft SQL Server receiver**
- **Kerberos authentication for beat receivers**: Kerberos/GSSAPI authentication for beat receivers (Filebeat receiver, Metricbeat receiver) is not supported.
- **API key authentication extension**: Not FIPS-compliant. Uses a PBKDF2 implementation outside the certified FIPS module boundary when active.

If you are using a component not listed here and are unsure whether it is FIPS compliant, contact [Elastic Support](https://www.elastic.co/support).

### Elastic Integrations that are not FIPS compatible

The following Fleet-managed Elastic Integrations use cryptographic implementations outside Go's certified FIPS module boundary for core functionality. These integrations cannot be used in FIPS environments, even if combined with other ingest tools that offer FIPS mode.
For EDOT-specific limitations, refer to [Elastic Agent in OpenTelemetry mode (EDOT)](#ingest-limitations-edot).
- [Azure Logs Integration (v2 preview)](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/azure/events)
- [Azure Event Hub Input](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/azure/eventhub)
- [Azure AI Foundry Integration](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/azure_ai_foundry)
- [Azure App Service Integration](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/azure_app_service)
- [Azure Application Insights Integration](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/azure_application_insights)
- [Azure Billing Metrics Integration](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/azure_billing)
- [Azure Functions Integration](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/azure_functions)
- [Custom Azure Logs Integration](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/azure_logs)
- [Azure Resource Metrics Integration](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/azure_metrics)
- [Azure OpenAI Integration](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/azure_openai)
- [SQL Input](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/sql)
- [PostgreSQL Integration](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/postgresql)
- [MongoDB Integration](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/mongodb)
- [MySQL Integration](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/mysql)
- [Microsoft SQL Server Integration](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/microsoft_sqlserver)
- [Oracle Integration](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/oracle)
- [Elastic Defend](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3895/reference/endpoint)