You can configure your VMware Cloud Director appliance to use FIPS 140-2 validated cryptographic modules and to run in FIPS-compliant mode.
The Federal Information Processing Standard (FIPS) 140-2 is a U.S. and Canadian government standard that specifies security requirements for cryptographic modules. The NIST Cryptographic Module Validation Program (CMVP) validates the cryptographic modules compliant with the FIPS 140-2 standards.
The goal of VMware Cloud Director FIPS support is to ease the compliance and security activities in various regulated environments. To learn more about support for FIPS 140-2 in VMware products, see https://www.vmware.com/security/certifications/fips.html.
VMware Cloud Director FIPS-validated cryptography is deactivated by default. By activating FIPS mode, you configure VMware Cloud Director to use FIPS 140-2 validated cryptographic modules and to run in FIPS-compliant mode.
VMware Cloud Director uses the following FIPS 140-2 validated cryptographic modules:
- VMware’s BC-FJA (Bouncy Castle FIPS Java API), version 1.0.2.3: Certificate #3673 (under NIST review for 1.0.2.3. Approved for version 1.0.2.1. Corresponding Bouncy Castle FIPS module approved for version 1.0.2.3 per Certificate #3514)
- VMware’s OpenSSL FIPS Object Module, version 2.0.20-vmw: Certificate #3857
- Appliance FIPS mode is the mode of the underlying appliance OS, embedded database, and various system libraries.
- Cell FIPS mode is the mode of the VMware Cloud Director cell running on each appliance.
For activating and deactivating FIPS mode on VMware Cloud Director on Linux, see Enable FIPS Mode on the Cells in the Server Group.
Prerequisites
- If metrics collection is activated, verify that the Cassandra certificates follow the X.509 v3 certificate standard and include all the necessary extensions. You must configure Cassandra with the same cipher suites that VMware Cloud Director uses. For information about the allowed SSL ciphers, see Managing the List of Allowed SSL Ciphers.
- If you want to use SAML encryption, you must regenerate one of the key pairs for the existing organizations and re-exchange the SAML metadata. Organizations created with VMware Cloud Director 10.2.x and earlier, have two identical key pairs and you must regenerate one of the key pairs. Organizations created with VMware Cloud Director 10.3 and later have two distinct key pairs and you do not need to regenerate any of them.
Procedure
What to do next
- To confirm the state of the cells, see View the FIPS Mode of Your VMware Cloud Director Appliance.
- To avoid host header injection vulnerabilities, activate host header verification.
- Log in directly or by using an SSH client to the VMware Cloud Director console as root.
- Activate host header verification using the cell management tool.
/opt/vmware/vcloud-director/bin/cell-management-tool manage-config -n vcloud.http.enableHostHeaderCheck -v true