--- title: Managing Federal Information Processing Standards (FIPS) mode description: Federal Information Processing Standards (FIPS) mode ensures that PingAccess uses encryption algorithms that meet FIPS requirements. component: pingaccess version: 8.1 page_id: pingaccess:configuring_and_customizing_pingaccess:pa_fips_mode canonical_url: https://docs.pingidentity.com/pingaccess/9.1/configuring_and_customizing_pingaccess/pa_fips_mode.html llms_txt: https://docs.pingidentity.com/pingaccess/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: August 23, 2023 superseded_by: https://docs.pingidentity.com/pingaccess/9.1/configuring_and_customizing_pingaccess/pa_fips_mode.html section_ids: enabling-fips-mode: Enabling FIPS mode about-this-task: About this task steps: Steps example: Example: disabling-fips-mode: Disabling FIPS Mode about-this-task-2: About this task steps-2: Steps --- # Managing Federal Information Processing Standards (FIPS) mode Federal Information Processing Standards (FIPS) mode ensures that PingAccess uses encryption algorithms that meet FIPS requirements. When FIPS mode is enabled, PingAccess updates the `security.providers` list to use the Bouncy Castle FIPS (BCFIPS) provider and removes all unneeded security providers that are not FIPS-compliant. > **Collapse: Viewing your environment's FIPS mode status** > > If FIPS mode is enabled, you can view your environment's FIPS mode status in the administrative console or the audit log: > > * To view FIPS mode in the administrative console, go to **Account → About** and in the **System Information** section, find FIPS mode status. > > * To view FIPS mode in the audit log, review the audit log after starting PingAccess. If FIPS mode is enabled, an info-level entry indicates this status. For example: > > ``` > INFO [] Fipsconfig - PingAccess is currently running in FIPS Mode. > ``` > **Collapse: Feature changes in FIPS mode** > > Some features of PingAccess operate differently or are unavailable in FIPS mode. > > Certificate and private key format requirements: > > * In non-FIPS mode, PingAccess supports PKCS#12 and PEM-formatted certificates and private keys. It automatically detects which format was used. > > * In FIPS mode, PingAccess only supports PEM-formatted certificates and private keys. That is, key pairs can only be imported or exported using the PEM-encoded format. Only PBES2 and AES or Triple DES encryption are accepted and 128-bit salt is required. In practice, this could mean that you can only import PEM files generated by PingFederate. > > * For PEM files in FIPS mode, the private key must precede the certificates. > > Password format requirements: > > * In FIPS mode, the password must contain at least 14 characters. > > To manage FIPS mode, select a tab. * Enabling FIPS mode * Disabling FIPS mode ## Enabling FIPS mode ### About this task Enable FIPS mode to ensure that PingAccess exclusively uses encryption algorithms permitted by the FIPS standard. If your environment is clustered, make sure to perform this procedure on all nodes. | | | | - | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | In this procedure, you can manually specify security providers, TLS protocols, and TLS cipher suites that can be used. If your manual inclusions are not FIPS-compliant, your environment might not be FIPS-compliant even in FIPS mode. | ### Steps 1. Open the `/conf/fips-mode.properties` file, or create it if it has been removed. 2. Set the `pa.fips.mode` property to `true`. ``` pa.fips.mode=true ``` 3. **Optional:** Exempt one or more security providers from being excluded by FIPS mode by adding a comma-separated list of class names to the `pa.fips.additionalAllowedProviders` property. #### Example: ``` pa.fips.additionalallowedproviders=X,Y ``` 4. **Optional:** Add or remove TLS protocols by editing the `pa.fips.tls.protocols` property to include a comma-separated list of valid TLS protocols. The default is: ``` pa.fips.tls.protocols = TLSv1.2 ``` 5. **Optional:** Add or remove TLS cipher suites by editing the `pa.fips.tls.ciphers` property to include a comma-separated list of valid TLS cipher suites. The default is: ``` pa.fips.tls.ciphers = TLS_AES_256_GCM_SHA384, \ TLS_AES_128_GCM_SHA256, \ TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, \ TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, \ TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, \ TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, \ TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, \ TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, \ TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, \ TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, \ TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384, \ TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384, \ TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, \ TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, \ TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384, \ TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384, \ TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, \ TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256, \ TLS_EMPTY_RENEGOTIATION_INFO_SCSV ``` 6. Save and close the file. 7. Restart PingAccess. ## Disabling FIPS Mode ### About this task Disable FIPS Mode to allow the use of non-FIPS compliant encryption. If your environment is clustered, perform this procedure on all nodes. ### Steps 1. Open the `/conf/fips-mode.properties` file. 2. Set the `pa.fips.mode` property to `false`. ``` pa.fips.mode=false ``` 3. Save and close the file. 4. Restart PingAccess.