--- title: FIPS mode for Ingest tools description: Elastic Agent, Fleet Server, Filebeat, Metricbeat, and APM Server FIPS binaries are built and configured to use FIPS 140 validated cryptography. The FIPS... url: https://www.elastic.co/elastic/docs-builder/docs/4665/deploy-manage/security/fips-ingest products: - APM - Beats - Elastic Agent - Elastic Documentation - Fleet Server applies_to: - Elastic Stack: Generally available since 9.3, Preview from 9.1 to 9.2 --- # FIPS mode for Ingest tools Elastic Agent, Fleet Server, Filebeat, Metricbeat, and APM Server FIPS binaries are built and configured to use FIPS 140 validated cryptography. The FIPS standard and the platforms covered depend on the product and Elastic Stack version: | Ingest tool | FIPS 140-2 | FIPS 140-3 | |--------------------------------|------------------------------------------------|-----------------------------------| | Elastic Agent and Fleet Server | 9.1–9.5 on Linux | 9.6+ on Linux and Windows | | Filebeat and Metricbeat | 9.1–9.5 on Linux | 9.6+ on Linux and Windows | | APM Server | 9.1–9.2, 9.3.0–9.3.7, and 9.4.0–9.4.3 on Linux | 9.3.8+, 9.4.4+, and 9.5+ on Linux | FIPS 140-3 binaries use the [Go Cryptographic Module](https://go.dev/doc/security/fips140), the native FIPS 140-3 module in the Go standard library, which is validated under the Cryptographic Module Validation Program (CMVP). Specific components and configurations that fall outside the validated module boundary are documented in the [Limitations](#ingest-limitations-all) section. Elastic Stack: Planned Elastic Agent (including the bundled Fleet Server), Filebeat, and Metricbeat are FIPS 140-3 compliant. The 9.6 binaries use module version v1.0.0 (CMVP Certificate [#5247](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5247)). ## FIPS-compatible binaries and configuration FIPS compatible binaries are available for [download](https://www.elastic.co/downloads) for the following platforms and products: - **Linux**: - **Elastic Agent (which includes Fleet Server), Filebeat, and Metricbeat**: Look for the `Linux 64-bit (FIPS)` or `Linux aarch64 (FIPS)` platform option on the product download pages. - **APM Server**: Look for the `Linux x86_64 (FIPS)` or `Linux aarch64 (FIPS)` platform option on the APM Server download page. - Elastic Stack: Planned **Windows**: - **Elastic Agent (which includes Fleet Server), Filebeat, and Metricbeat**: Look for the Windows FIPS platform options on the product download pages. The default configurations provided in the binaries are FIPS compatible. Be sure to check and understand the implications of changing default configurations. ## Limitations ### TLS Only FIPS-approved TLS protocols, cipher suites, and curve types are allowed. For FIPS 140-3 binaries, these are the algorithms approved in the CMVP validation of the Go Cryptographic Module, such as [CMVP Certificate #5247](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5247). The certificate number changes with each new validation of the module. - The supported TLS versions are `TLS v1.2` and `TLS v1.3`. - The supported cipher suites are: - `TLS v1.2`: `ECDHE-RSA-AES-128-GCM-SHA256`, `ECDHE-RSA-AES-256-GCM-SHA384`, `ECDHE-ECDSA-AES-128-GCM-SHA256`, `ECDHE-ECDSA-AES-256-GCM-SHA384` - `TLS v1.3`: `TLS-AES-128-GCM-SHA256`, `TLS-AES-256-GCM-SHA384` - The supported curve types are `P-256`, `P-384` and `P-521`. - The minimum key length is 2048 bits for RSA keys. EC key size is determined by the curve in use. Support for encrypted private keys is not available, as the cryptographic modules used for decrypting password protected keys are not FIPS validated. If an output or any other component with an SSL key that is password protected is configured, the components will fail to load the key. When running in FIPS mode, you must provide non-encrypted keys. Be sure to enforce security in your FIPS environments through other means, such as strict file permissions and access controls on the key file itself, for example. These TLS related restrictions apply to Elastic Agent, Fleet Server, Filebeat, Metricbeat, and APM Server. ### General output and input limitations (Kerberos protocol) The Kerberos protocol is not supported for any output or input. This impacts [Filebeat](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/beats/filebeat/configuration-kerberos), [Metricbeat](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/beats/metricbeat/configuration-kerberos) and APM Server, as well as output configurations for Elastic Agent with Fleet Server. This also limits the available `sasl.mechanism` values for Kafka connections, including the Kafka output, the Filebeat Kafka input, and the Metricbeat Kafka module: - Elastic Stack: Planned `PLAIN`, `SCRAM-SHA-256`, and `SCRAM-SHA-512` are supported. - Elastic Stack: Generally available from 9.3 to 9.5, Elastic Stack: Preview from 9.1 to 9.2 Only `PLAIN` is supported. ### APM Server - The [Secrets Keystore](https://www.elastic.co/elastic/docs-builder/docs/4665/solutions/observability/apm/apm-server/secrets-keystore-for-secure-settings) is not supported. ### Filebeat - The [Secrets Keystore](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/beats/filebeat/keystore) is not supported. - The [Translate GUID processor](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/beats/filebeat/processor-translate-guid) is not supported. - The [Fingerprint processor](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/beats/filebeat/fingerprint) does not support the md5 and sha1 method. - The [Community ID Network Flowhash processor](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/beats/filebeat/community-id) is not supported. - The [Azure module](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/beats/filebeat/filebeat-module-azure) including the [Azure eventhub input](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/beats/filebeat/filebeat-input-azure-eventhub) and the [Azure Blob Storage Input](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-azure-blob-storage) are not supported. The [Add Cloud Metadata processor](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/beats/filebeat/add-cloud-metadata) does not support the Azure Virtual Machine provider. - The [Office 365 module (Beta)](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/beats/filebeat/filebeat-module-o365) and the [Office 365 input (Deprecated)](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-o365audit) are not supported. - The [GCP Pub/Sub input](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/beats/filebeat/filebeat-input-gcp-pubsub) and the [Google Cloud Storage input](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-gcs) are not supported. - The [Entity Analytics input](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-entity-analytics) is not supported. ### Metricbeat - The [Secrets Keystore](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/beats/metricbeat/keystore) is not supported. - The [Translate GUID processor](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/beats/metricbeat/processor-translate-guid) is not supported. - The [Fingerprint processor](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/beats/metricbeat/fingerprint) does not support the md5 and sha1 method. - The [Community ID Network Flowhash processor](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/beats/metricbeat/community-id) is not supported. - The [Azure module](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/beats/metricbeat/metricbeat-module-azure) is not supported. The [Add Cloud Metadata processor](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/beats/metricbeat/add-cloud-metadata) does not support the Azure Virtual Machine provider. - The [Google Cloud Platform module](https://www.elastic.co/docs/reference/beats/metricbeat/metricbeat-module-gcp) is not supported. - The [Beta KVM module](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/beats/metricbeat/metricbeat-module-kvm) is not supported. - The [Mongo DB module](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/beats/metricbeat/metricbeat-module-mongodb) is not supported. - The [MySQL](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/beats/metricbeat/metricbeat-module-mysql), [PostgreSQL](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/beats/metricbeat/metricbeat-module-postgresql), [MSSQL](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/beats/metricbeat/metricbeat-module-mssql) and [SQL](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/beats/metricbeat/metricbeat-module-sql) modules are not supported. - The [Oracle module](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/beats/metricbeat/metricbeat-module-oracle) is not supported. ### Elastic Agent and Fleet Server When you use Elastic Agent and Fleet Server, these limitations apply: - Some Elastic Integrations are not FIPS compatible, as they depend on functionality that is not supported for FIPS configuration. In general, when using Elastic Agent and Fleet Server, the same restrictions listed previously for Metricbeat and Filebeat modules, inputs, and processors apply. - Agent upgrade artifact verification uses GPG signature checking, which is outside the validated FIPS module boundary. - Browser Synthetics monitors are not supported in FIPS mode. - Elastic Stack: Planned Lightweight Synthetics monitors don't support NTLM authentication for HTTP monitors. - Elastic Stack: Generally available from 9.3 to 9.5, Elastic Stack: Preview from 9.1 to 9.2 Lightweight Synthetics monitors are not supported, because Heartbeat is not included in the Elastic Agent FIPS build. #### Elastic Agent configured as an OTel Collector When you run [Elastic Agent configured as an OTel Collector](https://www.elastic.co/elastic/docs-builder/docs/4665/reference/fleet/otel-agent), these additional limitations apply: - **Azure integrations**: PKCS#12 (`.pfx`) client certificates are not supported for Azure Active Directory authentication. Use client secrets, workload identity, managed identity, or PEM-encoded certificate and key files instead. - Elastic Stack: Generally available since 9.4 **Kafka metrics receiver**: SASL GSSAPI (Kerberos) is not supported. Use SASL/PLAIN or SASL/SCRAM over TLS, or mTLS. In 9.4.0 and 9.4.1, SASL/SCRAM uses cryptography outside the validated FIPS module boundary, so use SASL/PLAIN over TLS or mTLS instead. - **Kafka receiver** and **Kafka exporter**: Not included in FIPS builds in 9.3, 9.4.0–9.4.8, and 9.5.0–9.5.4. Included starting in 9.4.9, 9.5.5, and 9.6.0. When included, SASL GSSAPI (Kerberos) is not supported. Use SASL/PLAIN or SASL/SCRAM over TLS, or mTLS. - **Prometheus receiver**: Not included in FIPS builds. - The following receivers are not supported in FIPS mode: - **MongoDB receiver** - **MySQL receiver** - **Microsoft SQL Server receiver** - **Kerberos authentication for beat receivers**: Kerberos/GSSAPI authentication for beat receivers (Filebeat receiver, Metricbeat receiver) is not supported. - **API key authentication extension**: Uses a PBKDF2 implementation outside the validated FIPS module boundary when active, so it is not supported in FIPS mode. If you are using a component not listed here and are unsure whether it is supported in FIPS mode, contact [Elastic Support](https://www.elastic.co/support). Running [Elastic Agent configured as an OTel Collector](https://www.elastic.co/elastic/docs-builder/docs/4665/reference/fleet/otel-agent) is not supported in FIPS mode. This includes all receivers, such as the Filebeat receiver, the Metricbeat receiver, and the [Prometheus receiver](https://www.elastic.co/docs/reference/integrations/prometheus). ### Elastic Integrations that are not FIPS compatible The following Fleet-managed Elastic Integrations use cryptographic implementations outside Go's validated FIPS module boundary for core functionality. These integrations cannot be used in FIPS environments, even if combined with other ingest tools that offer FIPS mode. For limitations that apply when Elastic Agent is configured as an OTel Collector, refer to [Elastic Agent configured as an OTel Collector](#ingest-limitations-edot). - [Azure Logs Integration (v2 preview)](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/azure/events) - [Azure Event Hub Input](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/azure/eventhub) - [Azure AI Foundry Integration](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/azure_ai_foundry) - [Azure App Service Integration](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/azure_app_service) - [Azure Application Insights Integration](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/azure_application_insights) - [Azure Billing Metrics Integration](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/azure_billing) - [Azure Functions Integration](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/azure_functions) - [Custom Azure Logs Integration](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/azure_logs) - [Azure Resource Metrics Integration](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/azure_metrics) - [Azure OpenAI Integration](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/azure_openai) - [SQL Input](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/sql) - [PostgreSQL Integration](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/postgresql) - [MongoDB Integration](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/mongodb) - [MySQL Integration](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/mysql) - [Microsoft SQL Server Integration](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/microsoft_sqlserver) - [Oracle Integration](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/oracle) - [Elastic Defend](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/4665/reference/endpoint)