FIPS Compliance in Access Server
Understand FIPS 140-2 compliance in Access Server — how it behaves under FIPS mode, which cipher suites are approved, client requirements, and known installation warnings on Ubuntu and RHEL.
FIPS and Access Server
Federal Information Processing Standards FIPS 140-2/140-3 define security requirements for cryptographic modules that protect sensitive information. These standards are commonly relevant to federal compliance programs and organizations in regulated industries.
You can install Access Server on supported Linux operating systems that provide cryptographic modules validated through the National Institute of Standards and Technology (NIST) Cryptographic Module Validation Program (CMVP).
Access Server uses the operating system's OpenSSL cryptographic module for its cryptographic operations. When FIPS mode is enabled on the Linux operating system, OpenSSL restricts cryptographic operations to approved cryptographic algorithms, and Access Server operates within those restrictions.
As a result:
Access Server rejects cryptographic algorithms that aren't permitted in FIPS mode.
VPN clients must negotiate FIPS-approved ciphers.
Optional algorithms such as ChaCha20-Poly1305 aren't available in a FIPS environment.
Access Server relies on the operating system's NIST-validated cryptographic module rather than providing a separate cryptographic module.
When Access Server runs on a supported Linux operating system with FIPS mode enabled, its cryptographic operations are limited to the approved algorithms provided by that operating system.
FIPS compliance is also a common requirement for organizations implementing Zero Trust Network Access in regulated or government environments.
For step-by-step instructions
To enable and verify FIPS mode on Ubuntu or Red Hat Enterprise Linux, refer to Tutorial: Enable FIPS Mode on Ubuntu and RHEL for Access Server.
Feature / Behavior | Default Mode (FIPS disabled) | FIPS Mode Enabled |
|---|---|---|
Cryptographic backend | Operating system-provided OpenSSL | Operating system-provided OpenSSL with FIPS enforcement |
Approved cryptographic algorithms | All algorithms supported by the configuration may be available | Restricted to algorithms permitted by the operating system's FIPS cryptographic module |
Use of non-FIPS ciphers | Allowed when supported, such as ChaCha20-Poly1305 | Not allowed |
Client cipher enforcement | Clients can negotiate supported ciphers | Clients must use FIPS-approved ciphers |
Optional cryptographic features | Available when supported | Features that rely on non-approved algorithms aren't available |
FIPS compliance | Not enforced | Enforced by the operating system cryptographic module |
Operating system recommendation
For general Access Server deployments, we typically recommend Ubuntu LTS because it provides a good balance of long-term support and current software.
For deployments that require FIPS compliance, use a supported operating system with a NIST-validated cryptographic module and enable FIPS mode according to the operating system vendor's guidance.
Access Server has been tested in FIPS mode on:
Red Hat Enterprise Linux (RHEL).
Ubuntu with Ubuntu Pro FIPS support.
For deployment and verification steps, refer to Tutorial: Enable FIPS Mode on Ubuntu and RHEL for Access Server.
How to enable FIPS mode
FIPS enforcement is configured at the operating system level, not directly in Access Server. The specific procedure depends on the Linux distribution.
Red Hat — How can I make RHEL FIPS compliant?
Ubuntu Pro or Ubuntu Pro FIPS — Enabling FIPS with the pro tool.
For both operating systems, you can also follow our Access Server-specific instructions in Tutorial: Enable FIPS Mode on Ubuntu and RHEL for Access Server.
Important
Enabling FIPS mode changes the operating system's cryptographic behavior and can prevent applications or integrations from using algorithms that aren't approved for the active FIPS configuration.
Test the configuration in a non-production environment before enabling it on a production Access Server.
Notes
Supported operating systems
We have tested Access Server in FIPS mode on the operating systems identified on this page.
Other Linux operating systems may support FIPS mode, but we haven't explicitly tested those configurations with Access Server.
Ubuntu requirements
Ubuntu LTS requires Ubuntu Pro or the appropriate Ubuntu Pro FIPS entitlement to install the packages required for FIPS mode.
Some infrastructure-as-a-service providers offer specialized Ubuntu Pro FIPS images with FIPS support already enabled.
FIPS-approved ciphers
After FIPS mode is enabled, Access Server and connected VPN clients must use cryptographic algorithms permitted by the operating system's FIPS module.
A client that attempts to use a cipher or cryptographic function that isn't approved in the active FIPS configuration won't be able to use that algorithm.
For example, ChaCha20-Poly1305 isn't available when the operating system restricts Access Server to FIPS-approved ciphers.
GPG warning during installation
You may see the following warning while installing Access Server:
gpg: out of core handler ignored in FIPS mode
This can occur while the PGP key for the Access Server software repository is being added. GPG may report the warning as it processes existing keys that don't meet the system's FIPS requirements.
The Access Server repository key can still install successfully, and the installation can continue.
OpenSSL DRBG warning
You may see the following warning during installation or when setting a local account password from the command line:
UserWarning: OpenSSL FIPS mode is enabled. Can't enable DRBG fork safety.
This warning can appear on older supported environments, including Red Hat 7 or Amazon Linux 2. It's benign and doesn't prevent Access Server from operating.
Access Server 2.14 and newer no longer support Amazon Linux 2.