FIPS mode for Ingest tools

Elastic Agent, Fleet Server, Filebeat, Metricbeat, and APM Server FIPS binaries are built and configured to use FIPS 140 validated cryptography. The FIPS standard and the platforms covered depend on the product and Elastic Stack version:

Ingest tool FIPS 140-2 FIPS 140-3
Elastic Agent and Fleet Server 9.1–9.5 on Linux 9.6+ on Linux and Windows
Filebeat and Metricbeat 9.1–9.5 on Linux 9.6+ on Linux and Windows
APM Server 9.1–9.2, 9.3.0–9.3.7, and 9.4.0–9.4.3 on Linux 9.3.8+, 9.4.4+, and 9.5+ on Linux

FIPS 140-3 binaries use the Go Cryptographic Module, the native FIPS 140-3 module in the Go standard library, which is validated under the Cryptographic Module Validation Program (CMVP). Specific components and configurations that fall outside the validated module boundary are documented in the Limitations section.

Elastic Agent (including the bundled Fleet Server), Filebeat, and Metricbeat are FIPS 140-3 compliant. The 9.6 binaries use module version v1.0.0 (CMVP Certificate #5247).

FIPS compatible binaries are available for download for the following platforms and products:

  • Linux:
    • Elastic Agent (which includes Fleet Server), Filebeat, and Metricbeat: Look for the Linux 64-bit (FIPS) or Linux aarch64 (FIPS) platform option on the product download pages.
    • APM Server: Look for the Linux x86_64 (FIPS) or Linux aarch64 (FIPS) platform option on the APM Server download page.
  • Windows:
    • Elastic Agent (which includes Fleet Server), Filebeat, and Metricbeat: Look for the Windows FIPS platform options on the product download pages.
Important

The default configurations provided in the binaries are FIPS compatible. Be sure to check and understand the implications of changing default configurations.

Only FIPS-approved TLS protocols, cipher suites, and curve types are allowed. For FIPS 140-3 binaries, these are the algorithms approved in the CMVP validation of the Go Cryptographic Module, such as CMVP Certificate #5247. The certificate number changes with each new validation of the module.

  • The supported TLS versions are TLS v1.2 and TLS v1.3.
  • The supported cipher suites are:
    • TLS v1.2: ECDHE-RSA-AES-128-GCM-SHA256, ECDHE-RSA-AES-256-GCM-SHA384, ECDHE-ECDSA-AES-128-GCM-SHA256, ECDHE-ECDSA-AES-256-GCM-SHA384
    • TLS v1.3: TLS-AES-128-GCM-SHA256, TLS-AES-256-GCM-SHA384
  • The supported curve types are P-256, P-384 and P-521.
  • The minimum key length is 2048 bits for RSA keys. EC key size is determined by the curve in use.

Support for encrypted private keys is not available, as the cryptographic modules used for decrypting password protected keys are not FIPS validated. If an output or any other component with an SSL key that is password protected is configured, the components will fail to load the key. When running in FIPS mode, you must provide non-encrypted keys. Be sure to enforce security in your FIPS environments through other means, such as strict file permissions and access controls on the key file itself, for example.

These TLS related restrictions apply to Elastic Agent, Fleet Server, Filebeat, Metricbeat, and APM Server.

The Kerberos protocol is not supported for any output or input. This impacts Filebeat, Metricbeat and APM Server, as well as output configurations for Elastic Agent with Fleet Server.

This also limits the available sasl.mechanism values for Kafka connections, including the Kafka output, the Filebeat Kafka input, and the Metricbeat Kafka module:

  • PLAIN, SCRAM-SHA-256, and SCRAM-SHA-512 are supported.
  • Only PLAIN is supported.

When you use Elastic Agent and Fleet Server, these limitations apply:

  • Some Elastic Integrations are not FIPS compatible, as they depend on functionality that is not supported for FIPS configuration. In general, when using Elastic Agent and Fleet Server, the same restrictions listed previously for Metricbeat and Filebeat modules, inputs, and processors apply.
  • Agent upgrade artifact verification uses GPG signature checking, which is outside the validated FIPS module boundary.
  • Browser Synthetics monitors are not supported in FIPS mode.
  • Lightweight Synthetics monitors don't support NTLM authentication for HTTP monitors.
  • Lightweight Synthetics monitors are not supported, because Heartbeat is not included in the Elastic Agent FIPS build.

When you run Elastic Agent configured as an OTel Collector, these additional limitations apply:

  • Azure integrations: PKCS#12 (.pfx) client certificates are not supported for Azure Active Directory authentication. Use client secrets, workload identity, managed identity, or PEM-encoded certificate and key files instead.
  • Kafka metrics receiver: SASL GSSAPI (Kerberos) is not supported. Use SASL/PLAIN or SASL/SCRAM over TLS, or mTLS. In 9.4.0 and 9.4.1, SASL/SCRAM uses cryptography outside the validated FIPS module boundary, so use SASL/PLAIN over TLS or mTLS instead.
  • Kafka receiver and Kafka exporter: Not included in FIPS builds in 9.3, 9.4.0–9.4.8, and 9.5.0–9.5.4. Included starting in 9.4.9, 9.5.5, and 9.6.0. When included, SASL GSSAPI (Kerberos) is not supported. Use SASL/PLAIN or SASL/SCRAM over TLS, or mTLS.
  • Prometheus receiver: Not included in FIPS builds.
  • The following receivers are not supported in FIPS mode:
    • MongoDB receiver
    • MySQL receiver
    • Microsoft SQL Server receiver
  • Kerberos authentication for beat receivers: Kerberos/GSSAPI authentication for beat receivers (Filebeat receiver, Metricbeat receiver) is not supported.
  • API key authentication extension: Uses a PBKDF2 implementation outside the validated FIPS module boundary when active, so it is not supported in FIPS mode.

If you are using a component not listed here and are unsure whether it is supported in FIPS mode, contact Elastic Support.

Running Elastic Agent configured as an OTel Collector is not supported in FIPS mode. This includes all receivers, such as the Filebeat receiver, the Metricbeat receiver, and the Prometheus receiver.

The following Fleet-managed Elastic Integrations use cryptographic implementations outside Go's validated FIPS module boundary for core functionality. These integrations cannot be used in FIPS environments, even if combined with other ingest tools that offer FIPS mode.

For limitations that apply when Elastic Agent is configured as an OTel Collector, refer to Elastic Agent configured as an OTel Collector.