Supported databases

The following table describes database support in RHTAS FIPS mode, including minimum versions, required authentication methods, TLS requirements, unsupported configurations, and options for configuring an external database when the bundled database is not FIPS-compatible.

Trillian, the transparency log backend, requires SHA-256 based authentication. Legacy authentication methods that use SHA-1 or MD5 are not supported in FIPS mode.

Table 1. Database support in FIPS mode
Database Minimum Version Auth Method Supported

PostgreSQL

13+

scram-sha-256 (must be configured; default in 14+)

Yes

MySQL

8.0+

caching_sha2_password (default)

Yes

MariaDB (all versions)

 — 

mysql_native_password (SHA-1, protocol default)

No
Warning

The MariaDB instance shipped with RHTAS uses mysql_native_password (SHA-1) and is not suitable for FIPS mode. To run RHTAS in FIPS mode, configure an external MySQL 8.0+ or PostgreSQL 13+ database instead.

 Note

MySQL connections must use TLS to meet FIPS requirements. Without TLS, MySQL’s caching_sha2_password authentication uses a password exchange that is not FIPS-validated. To enable TLS, configure the trustedCA field on the Trillian specification with a ConfigMap containing the database server’s CA certificate. On OpenShift, the operator automatically configures TLS for the managed database by using service-serving certificates.