> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Federal Information Processing Standard (FIPS) 140-3

> Aviatrix version 9.0 transitions from FIPS 140-2 to FIPS 140-3, and starting in version 10.1 Aviatrix holds its own FIPS 140-3 certification covering the full IPsec dataplane, VPN, and control plane.

## Overview

Aviatrix version 9.0 transitions from FIPS 140-2 to FIPS 140-3. The FIPS 140-3
implementation uses the OpenSSL 3.x FIPS provider for cryptographic operations,
replacing the OpenSSL 1.x FIPS module used in previous versions.

Starting in version 10.1, Aviatrix holds its own FIPS 140-3 certification
covering the full IPsec data plane, VPN, and control plane. See
[FIPS 140-3 Certification Scope](#fips-140-3-certification-scope) for what this
certification covers and the [Compliance Statement](#compliance-statement) for
certificate details.

## FIPS 140-3 Certification Scope

FIPS 140-3 certification coverage has expanded across releases:

* Version 9.0 does not carry an Aviatrix-owned FIPS certification.
* Version 10.0 covers VPN and part, but not all, of the IPsec data plane under
  certificate #5231.
* Starting in version 10.1, certification covers the full IPsec data plane, VPN,
  and the control plane under certificate #5231:
  * Gateway-to-gateway IPsec tunnels
  * Site2Cloud (S2C) IPsec connections
  * VPN (UserVPN/OpenVPN)
  * Controller and CoPilot control plane

This certification does not cover other platform components outside the gateway
IPsec data plane, VPN, and control plane.

<Note>
  Aviatrix previously held a separate FIPS 140-2 certificate covering VPN only,
  on versions prior to 9.0. That certificate expired in October 2025.
</Note>

## Compliance Statement

Aviatrix holds a FIPS 140-3 validation certificate for the IPsec data plane,
VPN, and control plane scope described in
[FIPS 140-3 Certification Scope](#fips-140-3-certification-scope):

| Field              | Value                                                                                                      |
| ------------------ | ---------------------------------------------------------------------------------------------------------- |
| Module name        | Aviatrix Cloud Native Security Fabric Cryptographic Module                                                 |
| Certificate number | NIST CMVP [#5231](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5231) |
| Status             | Active                                                                                                     |
| Security level     | Level 1 (software)                                                                                         |
| Validated          | April 10, 2026                                                                                             |

For the full list of FIPS 140-3 approved algorithms and other certificate
details, see the certificate on the
[NIST Cryptographic Module Validation Program](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5231)
site.

Starting in version 9.0, the FIPS toggle at **Settings > Configuration >
General** displays "FIPS 140-3". For Controller versions below 9.0, the toggle
continues to display "FIPS 140-2".

For information about FIPS 140-2 (applicable to versions prior to 9.0), see the

<a href={"/docs/enterprise/" + "10.1" + "/reference/general/fips-140-2"}>
  FIPS 140-2 reference page
</a>

.

## Enabling FIPS Mode Requires Gateway Replacement

<Warning>
  Enabling FIPS 140-3 mode on an existing gateway requires replacing the
  gateway. Toggling the FIPS setting on a gateway that is already running does
  not enable FIPS mode.
</Warning>

To bring a gateway into FIPS 140-3 mode, deploy a new gateway with FIPS mode
enabled instead of enabling FIPS mode on a gateway that is already deployed. See
[Per-Gateway FIPS Mode](#per-gateway-fips-mode) to check whether a specific
gateway is currently running in FIPS 140-3 mode.

## Upgrade Requirements for FIPS-Enabled Gateways

<Warning>
  FIPS-enabled gateways require an image upgrade to move to version 9.0. A
  software upgrade is not supported and will fail.
</Warning>

If you attempt a software upgrade on a FIPS-enabled gateway to version 9.0, the
upgrade fails with the following error:

> FIPS mode is enabled, and this is an upgrade to 9.0. You must perform an image
> upgrade to enable FIPS 140-3.

The dry-run check detects this condition before the upgrade proceeds. Always run
a dry-run check before upgrading FIPS-enabled gateways to version 9.0.

## UserVPN CA Certificate Rotation

When the Controller is initialized, it generates a Certificate Authority (CA)
that issues certificates to UserVPN gateways. Controllers originally initialized
on version 7.1 or earlier generated this CA with a 1024-bit RSA key. The CA is
preserved across upgrades to avoid disrupting active UserVPN users. The FIPS
140-3 TLS provider does not accept 1024-bit RSA keys, so a UserVPN gateway whose
certificate chains to a 1024-bit CA cannot complete TLS handshakes after the
upgrade.

<Warning>
  If your Controller was originally initialized on version 7.1 or earlier, you
  must rotate the UserVPN CA to a key length supported by FIPS 140-3 (2048-bit
  or larger) **before** upgrading to version 9.0 with FIPS enabled. Failure to
  do so results in UserVPN TLS handshake failures and disconnected UserVPN
  clients after the upgrade.
</Warning>

For instructions on rotating the UserVPN CA, see
[UserVPN CA Rotation (legacy docs)](https://docs.aviatrix.com/documentation/latest/platform-administration/copilot/user-vpn-ca-rotation.html#when-to-rotate-the-ca).
This procedure is distinct from

<a href={"/docs/enterprise/" + "10.1" + "/guides/controlplane/internal-service-ca-rotation"}>Internal Service CA Rotation</a>
, which covers the CA used for control-plane and Site2Cloud (S2C) gateway
identities.

## Per-Gateway FIPS Mode

Starting in version 9.0, FIPS mode is tracked per-gateway in addition to the
global setting. Each gateway has a FIPS flag that indicates whether it was
deployed with FIPS enabled.

You can view the FIPS mode status for each gateway in the **Gateway Details**
view in CoPilot.

## VPN Client Compatibility

FIPS 140-3 gateways require OpenVPN clients running version 2.6.0 or later.

<Note>
  Older VPN clients that use legacy TLS settings may fail to connect to FIPS
  140-3 gateways. Ensure all VPN clients are updated to OpenVPN 2.6.0 or later
  before enabling FIPS 140-3.
</Note>

Clients running older versions of OpenVPN may encounter TLS handshake failures
with the error "no suitable signature algorithm". This occurs because the TLS
1.0 PRF with MD5+SHA1 is not supported under the FIPS 140-3 security policy.

## Rollback Behavior

Rolling back a FIPS 140-3 enabled VPN gateway from version 9.0 reverts it to the
standard (non-FIPS) OpenVPN container. This is expected behavior.

After a rollback, FIPS mode is no longer active on the gateway. To re-enable
FIPS 140-3, perform an image upgrade back to version 9.0.