FIPS 140-3 overview

When you deploy Red Hat Trusted Artifact Signer on FIPS-enabled clusters, FIPS mode activates automatically to support FIPS requirements.

Red Hat Trusted Artifact Signer components are written in Go and built with Red Hat's Go toolchain against the Go Cryptographic Module, a FIPS 140-3 validated module. When you deploy RHTAS on a FIPS-enabled OpenShift cluster, FIPS mode activates automatically and restricts cryptographic operations to FIPS-approved algorithms.

You do not need to configure FIPS manually. However, you might need to configure some components, such as the database backend, to use FIPS-compatible options.

On non-FIPS clusters, you can use all cryptographic algorithms.

Note

Some internal cluster communication between operator-managed components might not use TLS. Your external client traffic is protected by TLS at the Ingress or Route level.