You can configure VMware Cloud Director on Linux to use FIPS 140-2 validated cryptographic modules and to run in FIPS-compliant mode.
The Federal Information Processing Standard (FIPS) 140-2 is a U.S. and Canadian government standard that specifies security requirements for cryptographic modules. The NIST Cryptographic Module Validation Program (CMVP) validates the cryptographic modules compliant with the FIPS 140-2 standards.
The goal of VMware Cloud Director FIPS support is to ease the compliance and security activities in various regulated environments. To learn more about support for FIPS 140-2 in VMware products, see https://www.vmware.com/security/certifications/fips.html.
In VMware Cloud Director, FIPS-validated cryptography is disabled by default. By enabling FIPS mode, you configure VMware Cloud Director to use FIPS 140-2 validated cryptographic modules and to run in FIPS-compliant mode.
VMware Cloud Director uses the following FIPS 140-2 validated cryptographic modules:
- VMware’s BC-FJA (Bouncy Castle FIPS Java API), version 184.108.40.206: Certificate #3673
- VMware’s OpenSSL FIPS Object Module, version 2.0.20-vmw: Certificate #3857
For information about enabling FIPS mode on the VMware Cloud Directorappliance, see Enable or Disable FIPS Mode on the VMware Cloud Director Appliance.
- Install and enable the
rng-toolsset of utilities. See https://wiki.archlinux.org/index.php/Rng-tools.
- If metrics collection is enabled, verify that the Cassandra certificates follow the X.509 v3 certificate standard and include all the necessary extensions. You must configure Cassandra with the same cipher suites that VMware Cloud Director uses. For information about the allowed SSL ciphers, see Managing the List of Allowed SSL Ciphers.
- If you want to use SAML encryption, you must regenerate one of the key pairs for the existing organizations and re-exchange the SAML metadata. Organizations created with VMware Cloud Director 10.2.x and earlier, have two identical key pairs and you must regenerate one of the key pairs. Organizations created with VMware Cloud Director 10.3 and later have two distinct key pairs and you do not need to regenerate any of them.
- From the top navigation bar, select Administration.
- In the left panel, under Settings, select SSL.
- Click Enable.
- Confirm that your environment meets all prerequisites to enabling FIPS mode.
If your environment does not meet all prerequisites before starting the FIPS mode configuration, VMware Cloud Director might become inaccessible.
- To confirm you want to start the process, click Enable.
When the configuration finishes, VMware Cloud Director displays a message to restart your cloud cells.
- After VMware Cloud Director displays a message to restart your cloud cells, restart every cell in the VMware Cloud Director server group.
What to do next
- Disable FIPS mode by clicking Disable, and after VMware Cloud Director indicates that the configuration is ready, restart the cells.
- You can view the FIPS status of the active VMware Cloud Director cells by using the fips-mode CMT command. See View the FIPS Status of All Active Cells in the VMware Cloud Director Installation, Configuration, and Upgrade Guide.