Cryptographic material validation

You can verify that your keys and certificates meet FIPS requirements by checking the validation status in FIPS mode.

When FIPS mode is active, the operator validates your keys, certificates, and TUF keys against the supported algorithms before any component uses them.

Password-protected keys
Copy link

You cannot use password-protected private keys, such as legacy PEM-encrypted keys, in FIPS mode. These keys rely on encryption algorithms that are not FIPS-validated.

KMS providers
Copy link

When you configure a component to use a KMS-based signer, such as AWS or a Tink signer, the operator does not validate the signer key. Your KMS provider is responsible for cryptographic protections, and the key does not pass through the operator.

FIPSCompliant status condition
Copy link

When FIPS mode is active, you can check the FIPSCompliant status condition on each component custom resource to see the validation result.

You see the following status for successful FIPS validation:

status:
  conditions:
    - type: FIPSCompliant
      status: "True"
      reason: FIPSValid

If validation fails, you see the specific issue in the status.