Starting with version 10.2.2, you can configure the VMware Cloud Director appliance to use FIPS 140-2 validated cryptographic modules and to run in FIPS-compliant mode.

The Federal Information Processing Standard (FIPS) 140-2 is a U.S. and Canadian government standard that specifies security requirements for cryptographic modules. The NIST Cryptographic Module Validation Program (CMVP) validates the cryptographic modules compliant with the FIPS 140-2 standards.

The goal of VMware Cloud Director FIPS support is to ease the compliance and security activities in various regulated environments. To learn more about support for FIPS 140-2 in VMware products, see https://www.vmware.com/security/certifications/fips.html.

VMware Cloud Director FIPS-validated cryptography is disabled by default. By enabling FIPS mode, you configure VMware Cloud Director to use FIPS 140-2 validated cryptographic modules and to run in FIPS-compliant mode.

Note: Enabling FIPS mode also enables reverse lookup of host names.

VMware Cloud Director uses the following FIPS 140-2 validated cryptographic modules:

When using the VMware Cloud Director appliance, to configure the appliance to run in FIPS-compliant mode, you must manage both the appliance FIPS mode and the cell FIPS mode.
  • Appliance FIPS mode is the mode of the underlying appliance OS, embedded database, and various system libraries.
  • Cell FIPS mode is the mode of the VMware Cloud Director cell running on each appliance.

For enabling and disabling FIPS mode on VMware Cloud Director on Linux, see Enable FIPS Mode on the Cells in the Server Group.

Prerequisites

  • If metrics collection is enabled, verify that the Cassandra certificates follow the X.509 v3 certificate standard and include all the necessary extensions. You must configure Cassandra with the same cipher suites that VMware Cloud Director uses. For information about the allowed SSL ciphers, see Managing the List of Allowed SSL Ciphers.
  • Unregister VMware Cloud Director from the vCenter Lookup Service. See Configure vSphere Services in the VMware Cloud Director Service Provider Admin Portal Guide.
  • If you want to use SAML encryption, you must regenerate one of the key pairs for the existing organizations and re-exchange the SAML metadata. Organizations created with VMware Cloud Director 10.2.x and earlier, have two identical key pairs and you must regenerate one of the key pairs. Organizations created with VMware Cloud Director 10.3 and later have two distinct key pairs and you do not need to regenerate any of them.

Procedure

  1. From the top navigation bar of the Service Provider Admin Portal, select Administration.
  2. In the left panel, under Settings, select SSL.
  3. Click Enable.
  4. To confirm that you want to start the process, click Enable.

    When the configuration finishes, VMware Cloud Director displays an Enable in Progress (Awaiting cells restart) message, and you can continue to step 5. When you enable or disable FIPS mode from the appliance management UI, the VMware Cloud Director appliance automatically restarts the cells.

  5. Log in as root to the appliance management UI at https://appliance_eth1_IP_address:5480.
  6. In the left panel, select the System Configuration tab.
  7. To turn on or turn off the appliance FIPS mode, click the Enable or Disable button for the node you are logged into.
    You can turn on or turn off the appliance FIPS mode only on the node you are logged into.
  8. Confirm the action and verify that FIPS mode is enabled or disabled successfully.
  9. Repeat step 5 to step 8 for each appliance, for example, primary, standby, and application types.

What to do next

To confirm the state of the cells, see View the VMware Cloud Director Appliance FIPS Mode.