FIPS compliance

The Federal Information Processing Standard (FIPS) Publication 140, titled "Security Requirements for Cryptographic Modules" is a U.S. government computer security standard used to approve cryptographic modules. FIPS 140-2 and its successor FIPS 140-3 define the security requirements that cryptographic modules must meet.

• Elasticsearch can run in a JVM configured with a FIPS-certified security provider, and supports the following FIPS compliant modes:
  • FIPS 140-2
  • FIPS 140-3
• Kibana offers FIPS 140-2 and FIPS 140-3 compliant modes, and as such can run in a Node.js environment configured with a FIPS 140-2 or FIPS 140-3 compliant OpenSSL3 provider.
• Some Ingest tools, including Elastic Agent, Fleet Server, Filebeat, Metricbeat, and APM Server, are available as FIPS compatible binaries. Depending on the product and version, these binaries use FIPS 140-2 or FIPS 140-3 validated cryptography. Refer to FIPS mode for Ingest tools for the versions in which each tool supports each standard.
• The self-hosted Elastic Package Registry for air-gapped environments is available as FIPS 140-3 compliant Docker images for Linux.