Your submission was sent successfully! Close

Jump to main content

FIPS 140-2 certification for Ubuntu 20.04 LTS!


on 11 August 2021

Ubuntu, the world’s most popular operating system across private and public clouds has received the FIPS 140-2, Level 1 certification for its cryptographic modules in Ubuntu 20.04 LTS, including OpenSSL 1.1.1. This certification is built on Canonical’s track record in designing Ubuntu for high security and regulated workloads. The FIPS 140-2 modules on Ubuntu 20.04 LTS enable organisations to run and develop applications and solutions for the US public sector and Federal government including regulated industries such as healthcare and finance.

The FIPS-certified modules for Ubuntu 20.04 LTS are available through Ubuntu Advantage subscription and Ubuntu Pro, alongside additional open source security and support services. To get started with Ubuntu for high security and regulated workloads contact our team.

On public clouds, Ubuntu Pro for AWS​ and ​Ubuntu Pro for Azure​ include subscriptions to Canonical’s FIPS 140-2 repositories, alongside expanded security and hardening.

Why is FIPS 140-2 important? 

Encryption is key to protecting sensitive data. In the world of encryption, there are several methodologies using different cryptographic algorithms to convert plain text into cipher text. Navigating multiple methodologies and algorithms creates a complex, labour-intensive process for teams evaluating the cryptographic services offered within software components. 

The U.S. Government addresses this challenge by mandating the use of Federal Information Processing Standard Publication (FIPS) 140-2 certified software within all federal agencies and entities that work with these agencies. FIPS 140-2 defines the critical security parameters that must be used for encryption in the products sold into the U.S. public sector.

FIPS 140-2 is, therefore, required under multiple compliance regimes, such as Federal Risk and Authorization Management Program (FedRAMP), Federal Information Security Management Act of 2002 (FISMA) and the Health Information Technology for Economic and Clinical Health Act (HITECH).

FIPS-certification ensures that software has been thoroughly reviewed and tested before being deployed and used within an agency or organisation requiring data encryption. Industries storing and processing sensitive data spans outside the public sector space, leading to FIPS-certified software being widely adopted within the payment card industry, healthcare and other regulated industries.

Ubuntu and NIST transition to FIPS 140-3

NIST is transitioning from the existing FIPS 140-2 standard to the new FIPS 140-3 revision. FIPS 140-3 aligns the general security requirements with ISO/IEC 19790 – an international standard- and after September 2021, it is expected to be the only active cryptographic certification mechanism by NIST. Existing certifications under FIPS 140-2 have a sunset date of five years from the validation date. Canonical is preparing Ubuntu for the new certification, and intends to provide FIPS 140-3 certified cryptographic packages on a future release of Ubuntu.

Which Ubuntu 20.04 packages versions are FIPS certified?

ComponentDescriptionVersionCMVP Certificate
Linux kernelThe Linux kernel cryptographic library5.4.0.1007.8#3928
OpenSSLGeneral purpose cryptographic library that includes TLS implementation1.1.1f#3966
LibgcryptThe GNUPG cryptographic general purpose library (provides fully certified full disk encryption)1.8.5#3902
StrongSwanIPSec based VPN solution5.8.2#4046

How can I get Ubuntu FIPS?

If you are already an Ubuntu Advantage customer, please refer to our FIPS documentation to learn more about FIPS in Ubuntu.

For a list of all current security certifications Canonical has, see Ubuntu security certifications and hardening standards.

Both FIPS-certified and FIPS-compliant modules for Ubuntu 20.04 LTS are offered with the Ubuntu Advantage for Infrastructure package.

Additionally, you can get optimised Ubuntu images with FIPS modules and other critical security and compliance services by default for public cloud with Ubuntu Pro for AWS and Ubuntu Pro for Azure.
Get FIPS for Ubuntu LTS

Newsletter signup

Select topics you're
interested in

In submitting this form, I confirm that I have read and agree to Canonical's Privacy Notice and Privacy Policy.

Related posts

FIPS certified vs compliant: what’s safer?

Minimise risk by treating the FIPS standard as a baseline, and going above and beyond the baseline to mitigate risk by applying security patches.

Air gapped network: FIPS 140 compliance with Ubuntu

Set up secure air gapped network and automate hardening, patch management and standards like CIS, DISA-STIG and FIPS 140-2 certifications on Ubuntu.

Linux security: your questions, answered

At Canonical, we often get questions about open-source security and of course, Linux security is a common topic. Based on a recent webinar hosted by our...