You can configure VMware Cloud Director 10.2.2 and later on Linux to use FIPS 140-2 validated cryptographic modules and to run in FIPS-compliant mode.

The Federal Information Processing Standard (FIPS) 140-2 is a U.S. and Canadian government standard that specifies security requirements for cryptographic modules. The NIST Cryptographic Module Validation Program (CMVP) validates the cryptographic modules compliant with the FIPS 140-2 standards.

The goal of VMware Cloud Director FIPS support is to ease the compliance and security activities in various regulated environments. To learn more about support for FIPS 140-2 in VMware products, see https://www.vmware.com/security/certifications/fips.html.

In VMware Cloud Director, FIPS-validated cryptography is disabled by default. By enabling FIPS mode, you configure VMware Cloud Director to use FIPS 140-2 validated cryptographic modules and to run in FIPS-compliant mode.

Note: Enabling FIPS mode also enables reverse lookup of host names.

In VMware Cloud Director 10.2.2 when you enable FIPS mode, you cannot encrypt SAML assertions. When not in FIPS mode, there is no restriction on assertion encryption.

VMware Cloud Director uses the following FIPS 140-2 validated cryptographic modules:

  • VMware’s BC-FJA (Bouncy Castle FIPS Java API), version 1.0.2.1: Certification is in progress.
  • VMware’s OpenSSL FIPS Object Module, version 2.0.20-vmw: Certificate #3857

VMware Cloud Director is in a bundle with the cell management tool (CMT). However, the cell management tool is not FIPS-compliant.

For information about enabling FIPS mode on the VMware Cloud Directorappliance, see Enable or Disable FIPS Mode on the VMware Cloud Director Appliance.

Prerequisites

  • Verify that the certificates have the KeyCertSign bit asserted by using OpenSSL. FIPS mode can function only if the VMware Cloud Director SSL certificates have the KeyCertSign asserted. 
    openssl crl2pkcs7 -nocrl -certfile certificates.pem | openssl pkcs7 -print_certs -text -noout
    If the certificates do not include the extension, specify the KeyCertSign bit when creating an SSL certificate keystore.
  • Install and enable the rng-tools set of utilities. See https://wiki.archlinux.org/index.php/Rng-tools.
  • If metrics collection is enabled, verify that the Cassandra certificates follow the X.509 v3 certificate standard and include all the necessary extensions. You must configure Cassandra with the same cipher suites that VMware Cloud Director uses. For information about the allowed SSL ciphers, see Managing the List of Allowed SSL Ciphers.
  • Unregister VMware Cloud Director from the vCenter Lookup Service. See Configure vSphere Services.

Procedure

  1. From the top navigation bar, select Administration.
  2. In the left panel, under Settings, select SSL.
  3. Click Enable.
  4. Confirm that your environment meets all prerequisites to enabling FIPS mode.
    If your environment does not meet all prerequisites before starting the FIPS mode configuration, VMware Cloud Director might become inaccessible.
  5. To confirm you want to start the process, click Enable.
    When the configuration finishes, VMware Cloud Director displays a message to restart your cloud cells.
  6. After VMware Cloud Director displays a message to restart your cloud cells, restart every cell in the VMware Cloud Director server group.

What to do next

  • Disable FIPS mode by clicking Disable, and after VMware Cloud Director indicates that the configuration is ready, restart the cells.
  • You can view the FIPS status of the active VMware Cloud Director cells by using the fips-mode CMT command. See View the FIPS Status of All Active Cells in the VMware Cloud Director Installation, Configuration, and Upgrade Guide.