Loading

FIPS mode for Ingest tools

Elastic Agent, Fleet, Filebeat, Metricbeat, and APM Server are FIPS 140-3 capable. They use Go's native FIPS 140-3 module (GOFIPS140=v1.0.0, CMVP Certificate #5247) for cryptographic operations. Specific components and configurations that fall outside the certified boundary are documented in the limitations sections below.

FIPS compatible binaries for Elastic Agent, Fleet, Filebeat, Metricbeat, and APM Server are available for download. Look for the Linux 64-bit (FIPS) or Linux aarch64 (FIPS) platform option on the product download pages for Elastic Agent and Fleet, Filebeat, and Metricbeat. Look for the Linux x86_64 (FIPS) or Linux aarch64 (FIPS) platform option on the APM Server download page.

Important

The default configurations provided in the binaries are designed for FIPS-capable operation. Review the limitations below to ensure your full deployment stays within the certified boundary.

Only FIPS 140-3 compliant TLS protocols, ciphers, and curve types are allowed to be used as listed in the following section.

  • The supported TLS versions are TLS v1.2 and TLS v1.3.
  • The supported cipher suites are:
    • TLS v1.2: ECDHE-RSA-AES-128-GCM-SHA256, ECDHE-RSA-AES-256-GCM-SHA384, ECDHE-ECDSA-AES-128-GCM-SHA256, ECDHE-ECDSA-AES-256-GCM-SHA384
    • TLS v1.3: TLS-AES-128-GCM-SHA256, TLS-AES-256-GCM-SHA384
  • The supported curve types are P-256, P-384 and P-521.
  • The minimum key length is 2048 bits for RSA keys. EC key size is determined by the curve in use; see the supported curve types above.

Support for encrypted private keys is not available, as the cryptographic modules used for decrypting password protected keys are not FIPS validated. If an output or any other component with an SSL key that is password protected is configured, the components will fail to load the key. When running in FIPS mode, you must provide non-encrypted keys. Be sure to enforce security in your FIPS environments through other means, such as strict file permissions and access controls on the key file itself, for example.

These TLS related restrictions apply to all components listed in the preceding section.

The Kerberos protocol is not supported for outputs and inputs in Filebeat, Metricbeat, APM Server, and Fleet Server configurations. This also restricts the available sasl.mechanism for the Kafka output, where only PLAIN is supported.

This impacts Filebeat, Metricbeat and APM Server, as well as output configurations for Elastic Agent with Fleet Server.

When you use Elastic Agent and Fleet Server, these limitations apply:

  • Some Elastic Integrations are not FIPS compatible, as they depend on functionality that is not supported for FIPS configuration. In general, when using Elastic Agent and Fleet Server, the same restrictions listed previously for Metricbeat and Filebeat modules, inputs, and processors apply.
  • Agent upgrade artifact verification uses GPG signature checking, which is outside Go's certified FIPS module boundary.

When running Elastic Agent in OpenTelemetry mode (EDOT), these additional limitations apply:

  • Azure integrations: PKCS#12 (.pfx) client certificates are not supported for Azure Active Directory authentication. Use client secrets, workload identity, managed identity, or PEM-encoded certificate and key files instead.
  • Kafka metrics receiver: SASL GSSAPI (Kerberos) is not supported. SASL SCRAM (SCRAM-SHA-256, SCRAM-SHA-512) is not FIPS-compliant. Use SASL/PLAIN over TLS or mTLS.
  • MongoDB receiver: Not supported in FIPS mode.
  • MySQL receiver: Not supported in FIPS mode.
  • Microsoft SQL Server receiver: Not supported in FIPS mode.
  • Kerberos authentication for beat receivers: Kerberos/GSSAPI authentication for beat receivers (Filebeat receiver, Metricbeat receiver) is not supported.
  • API key authentication extension: Not FIPS-compliant. Uses a PBKDF2 implementation outside the certified FIPS module boundary when active.

If you are using a component not listed here and are unsure whether it is FIPS compliant, contact Elastic Support.

The following Elastic Integrations (Fleet-managed) use cryptographic implementations outside Go's certified FIPS module boundary for core functionality and cannot be used in FIPS environments. For EDOT-specific limitations, see Elastic Agent in OpenTelemetry mode (EDOT).