Enabling FIPS Mode on RLC Pro Hardened

This guide describes how to enable FIPS (Federal Information Processing Standards) mode on RLC Pro Hardened. FIPS mode configures the system to use only FIPS 140-3 validated cryptographic modules, which is often a requirement for US federal government, defense, financial, and healthcare systems.

There are two supported ways to enable FIPS mode, depending on whether the system is new or already running:

New deployments: enable FIPS at install time (recommended).
Existing running systems: use fips-mode-setup --enable.

Warning

Enabling FIPS mode on an existing system is supported, but the fips-mode-setup tool itself warns that the operation cannot be undone and that enabling FIPS after installation is not recommended. It may also break existing applications or cryptographic material that depends on non-FIPS algorithms. For new systems, and for any regulated environment (e.g., DISA STIG) that must operate in FIPS mode from first boot, enable FIPS at install time instead. Take a full backup before enabling FIPS on an existing system.

FIPS mode vs. CIQ validated modules

Enabling FIPS mode (fips=1) turns on FIPS enforcement: the kernel and crypto libraries restrict themselves to FIPS-approved algorithms. It does not, by itself, determine which cryptographic modules are installed. To meet FIPS 140-3 requirements with CIQ's validated modules, the CIQ FIPS repositories must be enabled so the system uses CIQ's FIPS Certified or FIPS Compliant packages rather than the upstream Rocky Linux modules.

CIQ delivers those validated packages through a metapackage. A metapackage installs no software of its own; it lists a group of packages that belong together. Installing rlc-fips (Compliant) or rlc-fips-certified (Certified) therefore pulls in CIQ's complete validated FIPS package set in a single step, and keeps it locked so a later dnf update cannot replace the FIPS builds with non-FIPS versions. See Switching FIPS Modes for the metapackage install and how to choose a tier.

Note

Upstream Rocky Linux ships a FIPS mode, but those modules are not covered by CIQ's NIST certificates. FIPS mode is a configuration setting that tells the kernel and crypto libraries to restrict themselves to FIPS-approved algorithms. FIPS validation is a separate process: an accredited laboratory independently tests the cryptographic modules and NIST issues a certificate number on the CMVP validated modules list. Turning on FIPS mode against the upstream modules does not make them validated. Enable the CIQ FIPS repositories to use CIQ's validated modules; see the module certification status and the difference between FIPS Certified and FIPS Compliant.

Enabling FIPS mode

Choose the approach for your situation:

New system (install time, recommended)

Existing system

For new deployments, enable FIPS during installation. A kickstart configuration should:

Enable the CIQ FIPS repository and install the FIPS metapackage (rlc-fips, or rlc-fips-certified for pinned certified versions) so the validated modules are in place from first boot.
Boot the installer with FIPS enabled (fips=1) so the initial RAM disk (initramfs) is built with the FIPS integrity module already in place.

This is the cleanest path: the system boots directly into a consistent FIPS state, with no post-install reconfiguration and no risk of an inconsistent interim state.

Info

Exact kickstart directives for enabling the CIQ FIPS repositories and FIPS mode are environment-specific. Contact CIQ Support for a reference kickstart for your deployment.

On a running system, use the fips-mode-setup utility. This is the correct tool for the job because it performs three steps that manually adding fips=1 does not:

Installs the FIPS dracut module and regenerates the initramfs, so the FIPS power-on self-tests and integrity checks (including the kernel-binary checksum) are present at early boot.
Switches the system-wide crypto policy to FIPS.
Adds fips=1 and boot=UUID=<boot-filesystem> to the kernel command line via grubby, so the setting persists across kernel updates.

Warning

Do not enable FIPS by hand-editing the kernel command line. Adding fips=1 alone does not install the FIPS integrity module, omits the required boot=UUID= argument, and is not persistent across kernel updates. Always use fips-mode-setup --enable (which uses grubby under the hood) so the change is complete and survives updates.

Prerequisites

Root access: You must have root or sudo privileges.
CIQ FIPS packages installed: Install a FIPS metapackage before enabling FIPS mode, so the validated modules are in place first. Enabling FIPS mode without them leaves the system enforcing FIPS against the upstream Rocky modules, which are not covered by CIQ's certificates. Install only one metapackage; see Switching FIPS Modes to choose between Compliant and Certified.
```
sudo depot enable fips-9.6-compliant
sudo dnf install rlc-fips             # Compliant (recommended)
# or, for pinned certified versions:
# sudo dnf install rlc-fips-certified
```
Updated system: Ensure the system and kernel are fully updated first.
```
sudo dnf update -y
```

Steps

Check current status:


sudo fips-mode-setup --check

Expected output:


FIPS mode is disabled.

Enable FIPS mode:


sudo fips-mode-setup --enable

The tool prints a caution banner, regenerates the initramfs, and sets the crypto policy to FIPS:


*****************************************************************
* PRESS CONTROL-C WITHIN 15 SECONDS TO ABORT...                 *
*                                                               *
* ENABLING FIPS MODE AFTER THE INSTALLATION IS NOT RECOMMENDED. *
* THIS OPERATION CANNOT BE UNDONE.                              *
*****************************************************************
Kernel initramdisks are being regenerated. This might take some time.
Setting system policy to FIPS
FIPS mode will be enabled.
Please reboot the system for the setting to take effect.

Reboot the system:
```
sudo reboot
```

Verification

After the system reboots, confirm FIPS mode is active. On a correctly enabled system all of the following hold:

FIPS mode reported as enabled:


sudo fips-mode-setup --check


FIPS mode is enabled.

Kernel FIPS flag set:
```
cat /proc/sys/crypto/fips_enabled
```
```
1
```
Crypto policy is FIPS:
```
update-crypto-policies --show
```
```
FIPS
```
Kernel command line contains fips=1 (and the boot=UUID= argument added by fips-mode-setup):
```
cat /proc/cmdline
```
OpenSSL FIPS provider is active:
```
openssl list -providers
```
The output lists a fips provider with status: active.

Compliance Verification

You can verify your system's compliance status using the official RLC Pro Hardened compliance check script.

Using the Compliance Script

Download and run the check_compliance.sh script from the Verification Scripts page, then run it as root (sudo ./check_compliance.sh).

Sample Output: Compliant System

A properly configured FIPS system will show [PASS] for all checks and list the installed module versions.


========================================
 RLC Pro Hardened Compliance Status Check
========================================

Checking FIPS Mode... [PASS] (FIPS mode is enabled.)
Checking Crypto Policy... [PASS] (Current Policy: FIPS)
Checking SELinux Status... [PASS] (Mode: Enforcing)

----------------------------------------
 Validated Module Versions
----------------------------------------
Kernel Crypto API: 5.*
OpenSSL: 3.5.*
GnuTLS: 3.8.*
Libgcrypt: 1.10.*

========================================
 Check Complete
========================================

Sample Output: Non-Compliant System

If FIPS is disabled or policies are incorrect, the script will report failures.


========================================
 RLC Pro Hardened Compliance Status Check
========================================

Checking FIPS Mode... [FAIL] (FIPS mode is disabled.)
Checking Crypto Policy... [WARN] (Current Policy: DEFAULT - Expected: FIPS)
Checking SELinux Status... [PASS] (Mode: Enforcing)
...

Troubleshooting

FIPS mode shows as disabled after `dnf update`

If a system update installs a new kernel, the boot entry for that kernel must also carry the FIPS arguments. Re-running sudo fips-mode-setup --enable (then rebooting) reapplies the kernel command-line arguments via grubby for the current default kernel. Because fips-mode-setup uses grubby, avoid hand-editing GRUB entries, which do not persist.

`dracut` failures during enablement

If fips-mode-setup --enable fails with errors like:

dracut: installkernel failed in module kernel-modules-extra
dracut: Can't write to /boot/efi/...

This likely indicates an incomplete kernel installation or missing boot loader entries.

Resolution:

Ensure no package manager processes are stuck (e.g., dnf).
Reinstall the kernel core package to regenerate boot entries:
```
dnf reinstall kernel-core
```
If that fails, verify boot loader entries exist in /boot/loader/entries/. You can try manually adding the kernel entry:
```
kernel-install add <kernel-version> /lib/modules/<kernel-version>/vmlinuz
```

Overview Switching FIPS Modes (Compliant and Certified)